Test the fix in MR !1469 that fixes the issue in #840.
If a multi-part PDU is sent from a device to its own number, on receipt
the DELIVER PDU was incorrectly dropped because when comparing the new
parts to existing ones, the comparison found the original SUBMIT PDU.
Signed-off-by: Dan Williams <dan@ioncontrol.co>
The patch resolves a coredump caused by using 'client' instead of 'self'
in mm_obj_warn() call when failing to register tracking events.
Signed-off-by: shuihan-001 <xing1989093@outlook.com>
On my modem, AT!ICCID? command gives response without a preceding `!`:
```
AT!ICCID?
ICCID: 8970162010103256136
OK
```
Signed-off-by: Semyon Maryasin <simeon@maryasin.name>
device_caps_query_ready() declares caps_custom_data_class_str as
g_autofree without an initializer. On every early error return
(command failure such as a transaction timeout or NotOpened, or a
response parse failure) the variable is never assigned, so the
autofree cleanup runs g_free() on uninitialized stack garbage,
crashing ModemManager with a glibc "invalid free" abort (or SIGSEGV)
whenever the device caps query fails during modem initialization.
Fixes: 19c817cfe9 ("broadband-modem-mbim: consistently handle custom data classes")
Closes: #1094
Signed-off-by: Semyon Maryasin <simeon@maryasin.name>
The qcdm wwan device does not cope well with writing single bytes,
while it does not have any issue if longer chunks are written.
Fix qcdm_send accordingly, since it should not hurt the previously
supported devices.
Signed-off-by: Daniele Palmas <dnlplm@gmail.com>
Instead of using CFLAGS="-DMM_DISABLE_DEPRECATED" meson ...
which doesn't handle -Werror very well let's make it an explicit
option. Defaults to true, and autodetects previous CFLAGS
mechanism to preserve backwards compatibility.
Signed-off-by: Dan Williams <dan@ioncontrol.co>
Validate the active, candidate, and neighbor count fields in
qcdm_cmd_pilot_sets_result() before parsing the sets.
Ensure that the sum of counts does not exceed the size of the static
sets array in the response structure, and that the calculated size
based on the counts fits within the received buffer len.
https://gitlab.freedesktop.org/mobile-broadband/ModemManager/-/work_items/1069
Signed-off-by: Aleksander Morgado <aleksandermj@google.com>
Update parse_unsolicited() to re-check handler->callback on each
iteration of the match dispatch loop. If a URC handler callback clears
itself during dispatch (e.g. to stop listening), subsequent matches in
the same buffer would attempt to call the NULL pointer, causing a crash.
https://gitlab.freedesktop.org/mobile-broadband/ModemManager/-/work_items/1074
Signed-off-by: Aleksander Morgado <aleksandermj@google.com>
Use g_steal_pointer() when passing g_autoptr(GError) to
g_task_return_error() to prevent double-free by the automatic cleanup.
GTask takes ownership of the passed GError. If we use g_autoptr(GError)
locally, it will also call g_error_free() when the function returns,
causing a double-free / heap corruption. Stealing the pointer clears the
local variable and prevents the automatic cleanup.
https://gitlab.freedesktop.org/mobile-broadband/ModemManager/-/work_items/1073
Signed-off-by: Aleksander Morgado <aleksandermj@google.com>
Defer the validity change (which triggers modem reprobe/removal) to an
idle callback in rdy_handler().
Calling mm_base_modem_set_valid(FALSE) synchronously from the URC
handler triggers the immediate destruction of the modem object while the
serial port is still iterating the unsolicited message handlers. Deferring
the operation to an idle callback and taking a reference to the modem
ensures the modem object is kept alive until parse_unsolicited() has
returned.
https://gitlab.freedesktop.org/mobile-broadband/ModemManager/-/work_items/1072
Signed-off-by: Aleksander Morgado <aleksandermj@google.com>
Disconnect the 'list-configs' indication handler immediately inside the
callback. If the modem sends a duplicate indication before the whole
config load sequence completes, it could overwrite the stored
'get-config-info' signal handler ID, orphaning the old handler and
leading to a Use-After-Free when the GTask is completed and the
orphaned handler eventually fires.
https://gitlab.freedesktop.org/mobile-broadband/ModemManager/-/work_items/1071
Signed-off-by: Aleksander Morgado <aleksandermj@google.com>
Use g_signal_connect_object() to connect to child list/object signals
in the 3GPP, Messaging, Voice, and Cell Broadcast interfaces.
Passing the raw D-Bus skeleton pointer as user_data to these signals
can lead to a Use-After-Free if the skeleton is disposed of (e.g. on
hot-unplug) while the parent object or child list survives. By using
g_signal_connect_object(), the signal handlers are automatically
disconnected when the D-Bus skeleton is destroyed.
https://gitlab.freedesktop.org/mobile-broadband/ModemManager/-/work_items/1068
Signed-off-by: Aleksander Morgado <aleksandermj@google.com>
Introduce a timezone poll session ID to validate timezone load
results. This ensures that when a pending timezone load completes, we
discard the result if a new poll session has been started (e.g. due to
registration state changes) or if polling has been stopped.
This prevents leaking GSource timeout sources and a subsequent
Use-After-Free if the modem is hot-unplugged while a poll is pending.
https://gitlab.freedesktop.org/mobile-broadband/ModemManager/-/work_items/1067
Signed-off-by: Aleksander Morgado <aleksandermj@google.com>
Validate the number parameter in Voice.CreateCall and Call.Deflect
D-Bus methods to ensure they do not contain control characters or
semicolons. This prevents AT command injection when the number is
later spliced into ATD or +CTFR commands.
Introduce a common helper mm_utils_is_valid_dial_number() to validate
dial numbers, and add unit tests for it.
https://gitlab.freedesktop.org/mobile-broadband/ModemManager/-/work_items/1067
Signed-off-by: Aleksander Morgado <aleksandermj@google.com>
Validate preferred network operator codes in the SIM D-Bus interface
handler to ensure they are numeric. This prevents injecting AT
command delimiters (like CR) into this field, which is later spliced
into AT commands (+CPOL).
This change also plugs the network list leak, that was a problem on
its own.
https://gitlab.freedesktop.org/mobile-broadband/ModemManager/-/work_items/1065
Signed-off-by: Aleksander Morgado <aleksandermj@google.com>
Validate PIN and PUK codes in the SIM D-Bus interface handlers to
ensure they are numeric. This prevents injecting AT command
delimiters (like CR) into these fields, which are later spliced
into AT commands (+CPWD, +CLCK, +CPIN).
Introduce a common helper mm_utils_is_numeric() to check if a string
contains only digits, and add unit tests for it.
https://gitlab.freedesktop.org/mobile-broadband/ModemManager/-/work_items/1065
Signed-off-by: Aleksander Morgado <aleksandermj@google.com>
When sending an unencoded USSD command, the user-supplied string was
spliced directly into the +CUSD AT command. If the string contained
CR or semicolons, it could lead to AT command injection.
Use mm_at_quote_string() to properly quote and escape the USSD
command before sending it.
https://gitlab.freedesktop.org/mobile-broadband/ModemManager/-/work_items/1064
Signed-off-by: Aleksander Morgado <aleksandermj@google.com>
When parsing a SUPL address, if the host is not a valid IPv4 address,
validate it as a FQDN (allowing only alphanumeric characters, dots,
and hyphens). This prevents injecting AT command delimiters (like CR
or semicolon) into the host string, which is later spliced into
modem-specific AT commands (+XLCSSLP).
Introduce a common helper mm_utils_is_valid_fqdn() to validate FQDNs,
and add unit tests for it.
https://gitlab.freedesktop.org/mobile-broadband/ModemManager/-/work_items/1063
Signed-off-by: Aleksander Morgado <aleksandermj@google.com>
Alphanumeric SMS addresses decoded from GSM-7 could contain control
characters (like CR/LF), which could lead to AT command injection
if the address is later spliced into an AT+CMGS command during
stored SMS send fallback.
Sanitize the decoded address by removing all control characters.
Introduce a common helper mm_utils_remove_control_characters() to
remove control characters from a string in-place, and add unit
tests for it.
https://gitlab.freedesktop.org/mobile-broadband/ModemManager/-/work_items/1062
Signed-off-by: Aleksander Morgado <aleksandermj@google.com>
It's possible to use special name 'any' as a modem index. It's
especially useful if system has only single modem.
Signed-off-by: Andrey Skvortsov <andrej.skvortzov@gmail.com>
Most users have only single modem. Commands with '-m any' will work
even if modem gets new index, because it's restarted or is replugged.
Signed-off-by: Andrey Skvortsov <andrej.skvortzov@gmail.com>
Dan Williams
Semyon Maryasin
Christian Wendt
shuihan-001
Daniele Palmas
Nikolay Savchenko
Aleksander Morgado
Andrey Skvortsov
Aleksander Morgado
Марко М. Костић (Marko M. Kostić)