Validate the active, candidate, and neighbor count fields in
qcdm_cmd_pilot_sets_result() before parsing the sets.
Ensure that the sum of counts does not exceed the size of the static
sets array in the response structure, and that the calculated size
based on the counts fits within the received buffer len.
https://gitlab.freedesktop.org/mobile-broadband/ModemManager/-/work_items/1069
Signed-off-by: Aleksander Morgado <aleksandermj@google.com>
Update parse_unsolicited() to re-check handler->callback on each
iteration of the match dispatch loop. If a URC handler callback clears
itself during dispatch (e.g. to stop listening), subsequent matches in
the same buffer would attempt to call the NULL pointer, causing a crash.
https://gitlab.freedesktop.org/mobile-broadband/ModemManager/-/work_items/1074
Signed-off-by: Aleksander Morgado <aleksandermj@google.com>
Use g_steal_pointer() when passing g_autoptr(GError) to
g_task_return_error() to prevent double-free by the automatic cleanup.
GTask takes ownership of the passed GError. If we use g_autoptr(GError)
locally, it will also call g_error_free() when the function returns,
causing a double-free / heap corruption. Stealing the pointer clears the
local variable and prevents the automatic cleanup.
https://gitlab.freedesktop.org/mobile-broadband/ModemManager/-/work_items/1073
Signed-off-by: Aleksander Morgado <aleksandermj@google.com>
Defer the validity change (which triggers modem reprobe/removal) to an
idle callback in rdy_handler().
Calling mm_base_modem_set_valid(FALSE) synchronously from the URC
handler triggers the immediate destruction of the modem object while the
serial port is still iterating the unsolicited message handlers. Deferring
the operation to an idle callback and taking a reference to the modem
ensures the modem object is kept alive until parse_unsolicited() has
returned.
https://gitlab.freedesktop.org/mobile-broadband/ModemManager/-/work_items/1072
Signed-off-by: Aleksander Morgado <aleksandermj@google.com>
Disconnect the 'list-configs' indication handler immediately inside the
callback. If the modem sends a duplicate indication before the whole
config load sequence completes, it could overwrite the stored
'get-config-info' signal handler ID, orphaning the old handler and
leading to a Use-After-Free when the GTask is completed and the
orphaned handler eventually fires.
https://gitlab.freedesktop.org/mobile-broadband/ModemManager/-/work_items/1071
Signed-off-by: Aleksander Morgado <aleksandermj@google.com>
Use g_signal_connect_object() to connect to child list/object signals
in the 3GPP, Messaging, Voice, and Cell Broadcast interfaces.
Passing the raw D-Bus skeleton pointer as user_data to these signals
can lead to a Use-After-Free if the skeleton is disposed of (e.g. on
hot-unplug) while the parent object or child list survives. By using
g_signal_connect_object(), the signal handlers are automatically
disconnected when the D-Bus skeleton is destroyed.
https://gitlab.freedesktop.org/mobile-broadband/ModemManager/-/work_items/1068
Signed-off-by: Aleksander Morgado <aleksandermj@google.com>
Introduce a timezone poll session ID to validate timezone load
results. This ensures that when a pending timezone load completes, we
discard the result if a new poll session has been started (e.g. due to
registration state changes) or if polling has been stopped.
This prevents leaking GSource timeout sources and a subsequent
Use-After-Free if the modem is hot-unplugged while a poll is pending.
https://gitlab.freedesktop.org/mobile-broadband/ModemManager/-/work_items/1067
Signed-off-by: Aleksander Morgado <aleksandermj@google.com>
Validate the number parameter in Voice.CreateCall and Call.Deflect
D-Bus methods to ensure they do not contain control characters or
semicolons. This prevents AT command injection when the number is
later spliced into ATD or +CTFR commands.
Introduce a common helper mm_utils_is_valid_dial_number() to validate
dial numbers, and add unit tests for it.
https://gitlab.freedesktop.org/mobile-broadband/ModemManager/-/work_items/1067
Signed-off-by: Aleksander Morgado <aleksandermj@google.com>
Validate preferred network operator codes in the SIM D-Bus interface
handler to ensure they are numeric. This prevents injecting AT
command delimiters (like CR) into this field, which is later spliced
into AT commands (+CPOL).
This change also plugs the network list leak, that was a problem on
its own.
https://gitlab.freedesktop.org/mobile-broadband/ModemManager/-/work_items/1065
Signed-off-by: Aleksander Morgado <aleksandermj@google.com>
Validate PIN and PUK codes in the SIM D-Bus interface handlers to
ensure they are numeric. This prevents injecting AT command
delimiters (like CR) into these fields, which are later spliced
into AT commands (+CPWD, +CLCK, +CPIN).
Introduce a common helper mm_utils_is_numeric() to check if a string
contains only digits, and add unit tests for it.
https://gitlab.freedesktop.org/mobile-broadband/ModemManager/-/work_items/1065
Signed-off-by: Aleksander Morgado <aleksandermj@google.com>
When sending an unencoded USSD command, the user-supplied string was
spliced directly into the +CUSD AT command. If the string contained
CR or semicolons, it could lead to AT command injection.
Use mm_at_quote_string() to properly quote and escape the USSD
command before sending it.
https://gitlab.freedesktop.org/mobile-broadband/ModemManager/-/work_items/1064
Signed-off-by: Aleksander Morgado <aleksandermj@google.com>
When parsing a SUPL address, if the host is not a valid IPv4 address,
validate it as a FQDN (allowing only alphanumeric characters, dots,
and hyphens). This prevents injecting AT command delimiters (like CR
or semicolon) into the host string, which is later spliced into
modem-specific AT commands (+XLCSSLP).
Introduce a common helper mm_utils_is_valid_fqdn() to validate FQDNs,
and add unit tests for it.
https://gitlab.freedesktop.org/mobile-broadband/ModemManager/-/work_items/1063
Signed-off-by: Aleksander Morgado <aleksandermj@google.com>
Alphanumeric SMS addresses decoded from GSM-7 could contain control
characters (like CR/LF), which could lead to AT command injection
if the address is later spliced into an AT+CMGS command during
stored SMS send fallback.
Sanitize the decoded address by removing all control characters.
Introduce a common helper mm_utils_remove_control_characters() to
remove control characters from a string in-place, and add unit
tests for it.
https://gitlab.freedesktop.org/mobile-broadband/ModemManager/-/work_items/1062
Signed-off-by: Aleksander Morgado <aleksandermj@google.com>
The MTK specific modem object should be included in the 'mtk' shared
utils, so that they're available to other plugins.
Signed-off-by: Aleksander Morgado <aleksandermj@google.com>
Treat the following URCs as indications of possible SIM hot swap
events:
+SIM: Inserted
+SIM: Removed
+SIM DROP
Any time any of these is received, a SIM hot swap event is reported,
and the logic can then determine what to do. These should lead to
doing nothing if they happen as part of a controlled SIM slot switch.
Signed-off-by: Aleksander Morgado <aleksandermj@google.com>
If there is an ongoing SIM slot switch, we must ignore all SIM hotswap
related events happening during the process. The flag that is set in
the Modem interface private info to track this is never reset back to
FALSE on a successful SIM slot switch, it will be set for as long as
the modem object exists.
After the successful SIM slot switch, a new modem reprobe will be
requested, which leads to the old modem object to be disposed (the one
that had the flag set) and a new modem object created.
The logic that already existed in the MBIM modem object is now
generalized in the Modem interface itself so that SIM events reported
via other protocols are also properly ignored.
Signed-off-by: Aleksander Morgado <aleksandermj@google.com>
The libmm-glib library, as well as the ModemManager headers installed
as part of the D-Bus service API, have always been LGPLv2+ licensed,
because we want users of the service to rely on them in their own
programs, even if they are proprietary.
Some files had an incorrect GPLv2+ header instead of the LGPLv2+ and
that was confusing. All public headers in the MM API have the correct
license text now.
Signed-off-by: Aleksander Morgado <aleksandermj@chromium.org>
We provide a consolidated method to update the PS/EPS/5GS registration
states, based on the actual state reported via NAS and the availabiity
or not of the DSD data RAT.
On this consolidated method, we now force the IDLE state for every
case where it would have been HOME/ROAMING if the data RAT reported
via the DSD service is unknown. This includes not only transitions
into the HOME/ROAMING state, but also transitions to unknown data RAT.
Modem/SIM implementations that keep cached info that is not supposed
to change during runtime of a modem may need to be notified about when
a suspend/resume has happened, so that they can clear and reload the
internally cached data.
If the SIM swap check using ICCID or IMSI fail, don't completely fail
the operation, as the other one may still succeed.
Fail the operation only if both checks failed.
Aleksander Morgado