libmbim-glib: fix message validation in partial fragments

Fixes https://gitlab.freedesktop.org/mobile-broadband/libmbim/-/issues/33

2 files changed, 133 insertions, 45 deletions

diff --git a/src/libmbim-glib/mbim-message.c b/src/libmbim-glib/mbim-message.c
index 7244c65..2ee82dc 100644
--- a/src/libmbim-glib/mbim-message.c
+++ b/src/libmbim-glib/mbim-message.c
@@ -42,6 +42,17 @@
 
 /*****************************************************************************/
 
+#define MBIM_MESSAGE_IS_FRAGMENT(self)                                  \
+    (MBIM_MESSAGE_GET_MESSAGE_TYPE (self) == MBIM_MESSAGE_TYPE_COMMAND || \
+     MBIM_MESSAGE_GET_MESSAGE_TYPE (self) == MBIM_MESSAGE_TYPE_COMMAND_DONE || \
+     MBIM_MESSAGE_GET_MESSAGE_TYPE (self) == MBIM_MESSAGE_TYPE_INDICATE_STATUS)
+
+#define MBIM_MESSAGE_FRAGMENT_GET_TOTAL(self)                           \
+    GUINT32_FROM_LE (((struct full_message *)(self->data))->message.fragment.fragment_header.total)
+
+#define MBIM_MESSAGE_FRAGMENT_GET_CURRENT(self)                         \
+    GUINT32_FROM_LE (((struct full_message *)(self->data))->message.fragment.fragment_header.current)
+
 static void
 bytearray_apply_padding (GByteArray *buffer,
                          guint32    *len)
@@ -165,7 +176,7 @@ _mbim_message_validate_type_header (const MbimMessage  *self,
             /* ignore check */
             break;
         case MBIM_MESSAGE_TYPE_COMMAND:
-            message_header_size = sizeof (struct header) + sizeof (struct command_message);
+            message_header_size = sizeof (struct header) + sizeof (struct fragment_header);
             break;
         case MBIM_MESSAGE_TYPE_OPEN_DONE:
             message_header_size = sizeof (struct header) + sizeof (struct open_done_message);
@@ -174,14 +185,14 @@ _mbim_message_validate_type_header (const MbimMessage  *self,
             message_header_size = sizeof (struct header) + sizeof (struct close_done_message);
             break;
         case MBIM_MESSAGE_TYPE_COMMAND_DONE:
-            message_header_size = sizeof (struct header) + sizeof (struct command_done_message);
+            message_header_size = sizeof (struct header) + sizeof (struct fragment_header);
             break;
         case MBIM_MESSAGE_TYPE_FUNCTION_ERROR:
         case MBIM_MESSAGE_TYPE_HOST_ERROR:
             message_header_size = sizeof (struct header) + sizeof (struct error_message);
             break;
         case MBIM_MESSAGE_TYPE_INDICATE_STATUS:
-            message_header_size = sizeof (struct header) + sizeof (struct indicate_status_message);
+            message_header_size = sizeof (struct header) + sizeof (struct fragment_header);
             break;
         default:
         case MBIM_MESSAGE_TYPE_INVALID:
@@ -200,14 +211,26 @@ _mbim_message_validate_type_header (const MbimMessage  *self,
     return TRUE;
 }
 
-gboolean
-mbim_message_validate (const MbimMessage  *self,
-                       GError            **error)
+static gboolean
+_mbim_message_validate_partial_fragment (const MbimMessage  *self,
+                                         GError            **error)
 {
-    gsize message_size = 0;
-
-    if (!_mbim_message_validate_type_header (self, error))
+    if (MBIM_MESSAGE_FRAGMENT_GET_CURRENT (self) >= MBIM_MESSAGE_FRAGMENT_GET_TOTAL (self)) {
+        g_set_error (error, MBIM_CORE_ERROR, MBIM_CORE_ERROR_INVALID_MESSAGE,
+                     "Invalid message fragement (%u/%u)",
+                     MBIM_MESSAGE_FRAGMENT_GET_CURRENT (self),
+                     MBIM_MESSAGE_FRAGMENT_GET_TOTAL (self));
         return FALSE;
+    }
+
+    return TRUE;
+}
+
+static gboolean
+_mbim_message_validate_complete_fragment (const MbimMessage  *self,
+                                          GError            **error)
+{
+    gsize message_size = 0;
 
     /* Get information buffer size */
     switch (MBIM_MESSAGE_GET_MESSAGE_TYPE (self)) {
@@ -229,8 +252,6 @@ mbim_message_validate (const MbimMessage  *self,
         case MBIM_MESSAGE_TYPE_OPEN_DONE:
         case MBIM_MESSAGE_TYPE_CLOSE_DONE:
         case MBIM_MESSAGE_TYPE_FUNCTION_ERROR:
-            /* ignore check */
-            break;
         case MBIM_MESSAGE_TYPE_INVALID:
         default:
             g_assert_not_reached ();
@@ -238,15 +259,39 @@ mbim_message_validate (const MbimMessage  *self,
     }
 
     /* The information buffer must fit within the message contents */
-    if (message_size && (MBIM_MESSAGE_GET_MESSAGE_LENGTH (self) < message_size)) {
+    if (MBIM_MESSAGE_GET_MESSAGE_LENGTH (self) < message_size) {
         g_set_error (error, MBIM_CORE_ERROR, MBIM_CORE_ERROR_INVALID_MESSAGE,
-                     "Invalid message size: information buffer incomplete");
+                     "Invalid complete fragment size: type header or information buffer incomplete (%u < %" G_GSIZE_FORMAT ")",
+                     MBIM_MESSAGE_GET_MESSAGE_LENGTH (self), message_size);
         return FALSE;
     }
 
     return TRUE;
 }
 
+static gboolean
+_mbim_message_validate_fragment (const MbimMessage  *self,
+                                 GError            **error)
+{
+    if (MBIM_MESSAGE_FRAGMENT_GET_TOTAL (self) > 1)
+        return _mbim_message_validate_partial_fragment (self, error);
+
+    return _mbim_message_validate_complete_fragment (self, error);
+}
+
+gboolean
+mbim_message_validate (const MbimMessage  *self,
+                       GError            **error)
+{
+    if (!_mbim_message_validate_type_header (self, error))
+        return FALSE;
+
+    if (!MBIM_MESSAGE_IS_FRAGMENT (self))
+        return TRUE;
+
+    return _mbim_message_validate_fragment (self, error);
+}
+
 /*****************************************************************************/
 
 static guint32
@@ -2145,18 +2190,6 @@ mbim_message_get_printable_full (const MbimMessage  *self,
 /*****************************************************************************/
 /* Fragment interface */
 
-#define MBIM_MESSAGE_IS_FRAGMENT(self)                                  \
-    (MBIM_MESSAGE_GET_MESSAGE_TYPE (self) == MBIM_MESSAGE_TYPE_COMMAND || \
-     MBIM_MESSAGE_GET_MESSAGE_TYPE (self) == MBIM_MESSAGE_TYPE_COMMAND_DONE || \
-     MBIM_MESSAGE_GET_MESSAGE_TYPE (self) == MBIM_MESSAGE_TYPE_INDICATE_STATUS)
-
-#define MBIM_MESSAGE_FRAGMENT_GET_TOTAL(self)                           \
-    GUINT32_FROM_LE (((struct full_message *)(self->data))->message.fragment.fragment_header.total)
-
-#define MBIM_MESSAGE_FRAGMENT_GET_CURRENT(self)                         \
-    GUINT32_FROM_LE (((struct full_message *)(self->data))->message.fragment.fragment_header.current)
-
-
 gboolean
 _mbim_message_is_fragment (const MbimMessage *self)
 {
@@ -2596,6 +2629,8 @@ mbim_message_command_get_service (const MbimMessage *self)
     g_return_val_if_fail (self != NULL, MBIM_SERVICE_INVALID);
     g_return_val_if_fail (_mbim_message_validate_type_header (self, NULL), MBIM_SERVICE_INVALID);
     g_return_val_if_fail (MBIM_MESSAGE_GET_MESSAGE_TYPE (self) == MBIM_MESSAGE_TYPE_COMMAND, MBIM_SERVICE_INVALID);
+    g_return_val_if_fail (MBIM_MESSAGE_FRAGMENT_GET_TOTAL (self) == 1, MBIM_SERVICE_INVALID);
+    g_return_val_if_fail (_mbim_message_validate_complete_fragment (self, NULL), MBIM_SERVICE_INVALID);
 
     return mbim_uuid_to_service ((const MbimUuid *)&(((struct full_message *)(self->data))->message.command.service_id));
 }
@@ -2606,6 +2641,8 @@ mbim_message_command_get_service_id (const MbimMessage *self)
     g_return_val_if_fail (self != NULL, MBIM_UUID_INVALID);
     g_return_val_if_fail (_mbim_message_validate_type_header (self, NULL), MBIM_UUID_INVALID);
     g_return_val_if_fail (MBIM_MESSAGE_GET_MESSAGE_TYPE (self) == MBIM_MESSAGE_TYPE_COMMAND, MBIM_UUID_INVALID);
+    g_return_val_if_fail (MBIM_MESSAGE_FRAGMENT_GET_TOTAL (self) == 1, MBIM_UUID_INVALID);
+    g_return_val_if_fail (_mbim_message_validate_complete_fragment (self, NULL), MBIM_UUID_INVALID);
 
     return (const MbimUuid *)&(((struct full_message *)(self->data))->message.command.service_id);
 }
@@ -2616,6 +2653,8 @@ mbim_message_command_get_cid (const MbimMessage *self)
     g_return_val_if_fail (self != NULL, 0);
     g_return_val_if_fail (_mbim_message_validate_type_header (self, NULL), 0);
     g_return_val_if_fail (MBIM_MESSAGE_GET_MESSAGE_TYPE (self) == MBIM_MESSAGE_TYPE_COMMAND, 0);
+    g_return_val_if_fail (MBIM_MESSAGE_FRAGMENT_GET_TOTAL (self) == 1, 0);
+    g_return_val_if_fail (_mbim_message_validate_complete_fragment (self, NULL), 0);
 
     return GUINT32_FROM_LE (((struct full_message *)(self->data))->message.command.command_id);
 }
@@ -2626,6 +2665,8 @@ mbim_message_command_get_command_type (const MbimMessage *self)
     g_return_val_if_fail (self != NULL, MBIM_MESSAGE_COMMAND_TYPE_UNKNOWN);
     g_return_val_if_fail (_mbim_message_validate_type_header (self, NULL), MBIM_MESSAGE_COMMAND_TYPE_UNKNOWN);
     g_return_val_if_fail (MBIM_MESSAGE_GET_MESSAGE_TYPE (self) == MBIM_MESSAGE_TYPE_COMMAND, MBIM_MESSAGE_COMMAND_TYPE_UNKNOWN);
+    g_return_val_if_fail (MBIM_MESSAGE_FRAGMENT_GET_TOTAL (self) == 1, MBIM_MESSAGE_COMMAND_TYPE_UNKNOWN);
+    g_return_val_if_fail (_mbim_message_validate_complete_fragment (self, NULL), MBIM_MESSAGE_COMMAND_TYPE_UNKNOWN);
 
     return (MbimMessageCommandType) GUINT32_FROM_LE (((struct full_message *)(self->data))->message.command.command_type);
 }
@@ -2639,6 +2680,8 @@ mbim_message_command_get_raw_information_buffer (const MbimMessage *self,
     g_return_val_if_fail (self != NULL, NULL);
     g_return_val_if_fail (_mbim_message_validate_type_header (self, NULL), NULL);
     g_return_val_if_fail (MBIM_MESSAGE_GET_MESSAGE_TYPE (self) == MBIM_MESSAGE_TYPE_COMMAND, NULL);
+    g_return_val_if_fail (MBIM_MESSAGE_FRAGMENT_GET_TOTAL (self) == 1, NULL);
+    g_return_val_if_fail (_mbim_message_validate_complete_fragment (self, NULL), NULL);
 
     length = GUINT32_FROM_LE (((struct full_message *)(self->data))->message.command.buffer_length);
     if (out_length)
@@ -2658,6 +2701,8 @@ mbim_message_command_done_get_service (const MbimMessage *self)
     g_return_val_if_fail (self != NULL, MBIM_SERVICE_INVALID);
     g_return_val_if_fail (_mbim_message_validate_type_header (self, NULL), MBIM_SERVICE_INVALID);
     g_return_val_if_fail (MBIM_MESSAGE_GET_MESSAGE_TYPE (self) == MBIM_MESSAGE_TYPE_COMMAND_DONE, MBIM_SERVICE_INVALID);
+    g_return_val_if_fail (MBIM_MESSAGE_FRAGMENT_GET_TOTAL (self) == 1, MBIM_SERVICE_INVALID);
+    g_return_val_if_fail (_mbim_message_validate_complete_fragment (self, NULL), MBIM_SERVICE_INVALID);
 
     return mbim_uuid_to_service ((const MbimUuid *)&(((struct full_message *)(self->data))->message.command_done.service_id));
 }
@@ -2668,6 +2713,8 @@ mbim_message_command_done_get_service_id (const MbimMessage *self)
     g_return_val_if_fail (self != NULL, MBIM_UUID_INVALID);
     g_return_val_if_fail (_mbim_message_validate_type_header (self, NULL), MBIM_UUID_INVALID);
     g_return_val_if_fail (MBIM_MESSAGE_GET_MESSAGE_TYPE (self) == MBIM_MESSAGE_TYPE_COMMAND_DONE, MBIM_UUID_INVALID);
+    g_return_val_if_fail (MBIM_MESSAGE_FRAGMENT_GET_TOTAL (self) == 1, MBIM_UUID_INVALID);
+    g_return_val_if_fail (_mbim_message_validate_complete_fragment (self, NULL), MBIM_UUID_INVALID);
 
     return (const MbimUuid *)&(((struct full_message *)(self->data))->message.command_done.service_id);
 }
@@ -2678,6 +2725,8 @@ mbim_message_command_done_get_cid (const MbimMessage *self)
     g_return_val_if_fail (self != NULL, 0);
     g_return_val_if_fail (_mbim_message_validate_type_header (self, NULL), 0);
     g_return_val_if_fail (MBIM_MESSAGE_GET_MESSAGE_TYPE (self) == MBIM_MESSAGE_TYPE_COMMAND_DONE, 0);
+    g_return_val_if_fail (MBIM_MESSAGE_FRAGMENT_GET_TOTAL (self) == 1, 0);
+    g_return_val_if_fail (_mbim_message_validate_complete_fragment (self, NULL), 0);
 
     return GUINT32_FROM_LE (((struct full_message *)(self->data))->message.command_done.command_id);
 }
@@ -2688,6 +2737,8 @@ mbim_message_command_done_get_status_code (const MbimMessage *self)
     g_return_val_if_fail (self != NULL, MBIM_STATUS_ERROR_FAILURE);
     g_return_val_if_fail (_mbim_message_validate_type_header (self, NULL), MBIM_STATUS_ERROR_FAILURE);
     g_return_val_if_fail (MBIM_MESSAGE_GET_MESSAGE_TYPE (self) == MBIM_MESSAGE_TYPE_COMMAND_DONE, MBIM_STATUS_ERROR_FAILURE);
+    g_return_val_if_fail (MBIM_MESSAGE_FRAGMENT_GET_TOTAL (self) == 1, MBIM_STATUS_ERROR_FAILURE);
+    g_return_val_if_fail (_mbim_message_validate_complete_fragment (self, NULL), MBIM_STATUS_ERROR_FAILURE);
 
     return (MbimStatusError) GUINT32_FROM_LE (((struct full_message *)(self->data))->message.command_done.status_code);
 }
@@ -2701,6 +2752,8 @@ mbim_message_command_done_get_result (const MbimMessage  *self,
     g_return_val_if_fail (self != NULL, FALSE);
     g_return_val_if_fail (_mbim_message_validate_type_header (self, NULL), FALSE);
     g_return_val_if_fail (MBIM_MESSAGE_GET_MESSAGE_TYPE (self) == MBIM_MESSAGE_TYPE_COMMAND_DONE, FALSE);
+    g_return_val_if_fail (MBIM_MESSAGE_FRAGMENT_GET_TOTAL (self) == 1, FALSE);
+    g_return_val_if_fail (_mbim_message_validate_complete_fragment (self, NULL), FALSE);
 
     status = (MbimStatusError) GUINT32_FROM_LE (((struct full_message *)(self->data))->message.command_done.status_code);
     if (status == MBIM_STATUS_ERROR_NONE)
@@ -2719,6 +2772,8 @@ mbim_message_command_done_get_raw_information_buffer (const MbimMessage *self,
     g_return_val_if_fail (self != NULL, NULL);
     g_return_val_if_fail (_mbim_message_validate_type_header (self, NULL), NULL);
     g_return_val_if_fail (MBIM_MESSAGE_GET_MESSAGE_TYPE (self) == MBIM_MESSAGE_TYPE_COMMAND_DONE, NULL);
+    g_return_val_if_fail (MBIM_MESSAGE_FRAGMENT_GET_TOTAL (self) == 1, NULL);
+    g_return_val_if_fail (_mbim_message_validate_complete_fragment (self, NULL), NULL);
 
     length = GUINT32_FROM_LE (((struct full_message *)(self->data))->message.command_done.buffer_length);
     if (out_length)
@@ -2738,6 +2793,8 @@ mbim_message_indicate_status_get_service (const MbimMessage *self)
     g_return_val_if_fail (self != NULL, MBIM_SERVICE_INVALID);
     g_return_val_if_fail (_mbim_message_validate_type_header (self, NULL), MBIM_SERVICE_INVALID);
     g_return_val_if_fail (MBIM_MESSAGE_GET_MESSAGE_TYPE (self) == MBIM_MESSAGE_TYPE_INDICATE_STATUS, MBIM_SERVICE_INVALID);
+    g_return_val_if_fail (MBIM_MESSAGE_FRAGMENT_GET_TOTAL (self) == 1, MBIM_SERVICE_INVALID);
+    g_return_val_if_fail (_mbim_message_validate_complete_fragment (self, NULL), MBIM_SERVICE_INVALID);
 
     return mbim_uuid_to_service ((const MbimUuid *)&(((struct full_message *)(self->data))->message.indicate_status.service_id));
 }
@@ -2748,6 +2805,8 @@ mbim_message_indicate_status_get_service_id (const MbimMessage *self)
     g_return_val_if_fail (self != NULL, MBIM_UUID_INVALID);
     g_return_val_if_fail (_mbim_message_validate_type_header (self, NULL), MBIM_UUID_INVALID);
     g_return_val_if_fail (MBIM_MESSAGE_GET_MESSAGE_TYPE (self) == MBIM_MESSAGE_TYPE_INDICATE_STATUS, MBIM_UUID_INVALID);
+    g_return_val_if_fail (MBIM_MESSAGE_FRAGMENT_GET_TOTAL (self) == 1, MBIM_UUID_INVALID);
+    g_return_val_if_fail (_mbim_message_validate_complete_fragment (self, NULL), MBIM_UUID_INVALID);
 
     return (const MbimUuid *)&(((struct full_message *)(self->data))->message.indicate_status.service_id);
 }
@@ -2758,6 +2817,8 @@ mbim_message_indicate_status_get_cid (const MbimMessage *self)
     g_return_val_if_fail (self != NULL, 0);
     g_return_val_if_fail (_mbim_message_validate_type_header (self, NULL), 0);
     g_return_val_if_fail (MBIM_MESSAGE_GET_MESSAGE_TYPE (self) == MBIM_MESSAGE_TYPE_INDICATE_STATUS, 0);
+    g_return_val_if_fail (MBIM_MESSAGE_FRAGMENT_GET_TOTAL (self) == 1, 0);
+    g_return_val_if_fail (_mbim_message_validate_complete_fragment (self, NULL), 0);
 
     return GUINT32_FROM_LE (((struct full_message *)(self->data))->message.indicate_status.command_id);
 }
@@ -2771,6 +2832,8 @@ mbim_message_indicate_status_get_raw_information_buffer (const MbimMessage *self
     g_return_val_if_fail (self != NULL, NULL);
     g_return_val_if_fail (_mbim_message_validate_type_header (self, NULL), NULL);
     g_return_val_if_fail (MBIM_MESSAGE_GET_MESSAGE_TYPE (self) == MBIM_MESSAGE_TYPE_INDICATE_STATUS, NULL);
+    g_return_val_if_fail (MBIM_MESSAGE_FRAGMENT_GET_TOTAL (self) == 1, NULL);
+    g_return_val_if_fail (_mbim_message_validate_complete_fragment (self, NULL), NULL);
 
     length = GUINT32_FROM_LE (((struct full_message *)(self->data))->message.indicate_status.buffer_length);
     if (out_length)
@@ -2817,6 +2880,8 @@ mbim_message_response_get_result (const MbimMessage  *self,
         break;
 
     case MBIM_MESSAGE_TYPE_COMMAND_DONE:
+        g_return_val_if_fail (MBIM_MESSAGE_FRAGMENT_GET_TOTAL (self) == 1, FALSE);
+        g_return_val_if_fail (_mbim_message_validate_complete_fragment (self, NULL), FALSE);
         status = (MbimStatusError) GUINT32_FROM_LE (((struct full_message *)(self->data))->message.command_done.status_code);
         break;
 
diff --git a/src/libmbim-glib/test/test-fragment.c b/src/libmbim-glib/test/test-fragment.c
index 680039a..a7c2138 100644
--- a/src/libmbim-glib/test/test-fragment.c
+++ b/src/libmbim-glib/test/test-fragment.c
@@ -13,24 +13,34 @@
 static void
 test_fragment_receive_single (void)
 {
-    MbimMessage *message;
-    const guint8 *fragment_information_buffer;
-    guint32 fragment_information_buffer_length;
+    GError                 *error = NULL;
+    g_autoptr(MbimMessage)  message = NULL;
+    const guint8           *fragment_information_buffer;
+    guint32                 fragment_information_buffer_length;
 
     /* This buffer contains a single message composed of a single fragment.
      * We don't really care about the actual data included within the fragment. */
     const guint8 buffer [] =  {
         0x07, 0x00, 0x00, 0x80, /* indications have fragments */
-        0x1C, 0x00, 0x00, 0x00, /* length of this fragment */
+        0x2C, 0x00, 0x00, 0x00, /* length of this fragment */
         0x01, 0x00, 0x00, 0x00, /* transaction id */
         0x01, 0x00, 0x00, 0x00, /* total fragments */
         0x00, 0x00, 0x00, 0x00, /* current fragment */
-        0x01, 0x02, 0x03, 0x04, /* frament data */
-        0x05, 0x06, 0x07, 0x08 };
+        0x01, 0x02, 0x03, 0x04, /* fragment data (at least 24 bytes for an indication) */
+        0x05, 0x06, 0x07, 0x08,
+        0x09, 0x0A, 0x0B, 0x0C,
+        0x0D, 0x0E, 0x0F, 0x00,
+        0x11, 0x12, 0x13, 0x14,
+        0x00, 0x00, 0x00, 0x00, /* buffer length 0! */
+    };
 
     const guint8 data [] = {
         0x01, 0x02, 0x03, 0x04, /* same data as in the fragment */
-        0x05, 0x06, 0x07, 0x08
+        0x05, 0x06, 0x07, 0x08,
+        0x09, 0x0A, 0x0B, 0x0C,
+        0x0D, 0x0E, 0x0F, 0x00,
+        0x11, 0x12, 0x13, 0x14,
+        0x00, 0x00, 0x00, 0x00,
     };
 
     message = mbim_message_new (buffer, sizeof (buffer));
@@ -38,24 +48,25 @@ test_fragment_receive_single (void)
     g_assert_cmpuint (_mbim_message_fragment_get_total   (message), ==, 1);
     g_assert_cmpuint (_mbim_message_fragment_get_current (message), ==, 0);
 
+    g_assert (mbim_message_validate (message, &error));
+    g_assert_no_error (error);
+
     fragment_information_buffer = (_mbim_message_fragment_get_payload (
                                        message,
                                        &fragment_information_buffer_length));
 
     g_assert_cmpuint (fragment_information_buffer_length, ==, sizeof (data));
     g_assert (memcmp (fragment_information_buffer, data, fragment_information_buffer_length) == 0);
-
-    mbim_message_unref (message);
 }
 
 static void
 test_fragment_receive_multiple (void)
 {
-    GByteArray *bytearray;
-    MbimMessage *message;
-    GError *error = NULL;
-    const guint8 *fragment_information_buffer;
-    guint32 fragment_information_buffer_length;
+    g_autoptr(GByteArray)   bytearray = NULL;
+    g_autoptr(MbimMessage)  message = NULL;
+    GError                 *error = NULL;
+    const guint8           *fragment_information_buffer;
+    guint32                 fragment_information_buffer_length;
 
     /* This buffer contains several fragments of a single message.
      * We don't really care about the actual data included within the fragments. */
@@ -83,7 +94,7 @@ test_fragment_receive_multiple (void)
         0x04, 0x00, 0x00, 0x00, /* total fragments */
         0x02, 0x00, 0x00, 0x00, /* current fragment */
         0x10, 0x11, 0x12, 0x13, /* frament data */
-        0x14, 0x15, 0x16, 0x17,
+        0x04, 0x00, 0x00, 0x00,
         /* Fourth fragment */
         0x07, 0x00, 0x00, 0x80, /* indications have fragments */
         0x18, 0x00, 0x00, 0x00, /* length of this fragment */
@@ -99,12 +110,14 @@ test_fragment_receive_multiple (void)
         0x08, 0x09, 0x0A, 0x0B,
         0x0C, 0x0D, 0x0E, 0x0F,
         0x10, 0x11, 0x12, 0x13,
-        0x14, 0x15, 0x16, 0x17,
+        0x04, 0x00, 0x00, 0x00,
         0x18, 0x19, 0x1A, 0x1B
     };
 
     bytearray = g_byte_array_new ();
     g_byte_array_append (bytearray, buffer, sizeof (buffer));
+    g_assert (mbim_message_validate ((const MbimMessage *)bytearray, &error));
+    g_assert_no_error (error);
 
     /* First fragment creates the message */
     message = _mbim_message_fragment_collector_init ((const MbimMessage *)bytearray, &error);
@@ -112,8 +125,10 @@ test_fragment_receive_multiple (void)
     g_assert_cmpuint (_mbim_message_fragment_get_total   (message), ==, 4);
     g_assert_cmpuint (_mbim_message_fragment_get_current (message), ==, 0);
     g_assert         (_mbim_message_fragment_collector_complete (message) == FALSE);
-    g_byte_array_remove_range (bytearray, 0, mbim_message_get_message_length ((const MbimMessage *)bytearray));
 
+    g_byte_array_remove_range (bytearray, 0, mbim_message_get_message_length ((const MbimMessage *)bytearray));
+    g_assert (mbim_message_validate ((const MbimMessage *)bytearray, &error));
+    g_assert_no_error (error);
 
     /* Add second fragment */
     g_assert (_mbim_message_fragment_collector_add (message, (const MbimMessage *)bytearray, &error));
@@ -121,7 +136,10 @@ test_fragment_receive_multiple (void)
     g_assert_cmpuint (_mbim_message_fragment_get_total   (message), ==, 4);
     g_assert_cmpuint (_mbim_message_fragment_get_current (message), ==, 1);
     g_assert         (_mbim_message_fragment_collector_complete (message) == FALSE);
+
     g_byte_array_remove_range (bytearray, 0, mbim_message_get_message_length ((const MbimMessage *)bytearray));
+    g_assert (mbim_message_validate ((const MbimMessage *)bytearray, &error));
+    g_assert_no_error (error);
 
     /* Add third fragment */
     g_assert (_mbim_message_fragment_collector_add (message, (const MbimMessage *)bytearray, &error));
@@ -129,7 +147,10 @@ test_fragment_receive_multiple (void)
     g_assert_cmpuint (_mbim_message_fragment_get_total   (message), ==, 4);
     g_assert_cmpuint (_mbim_message_fragment_get_current (message), ==, 2);
     g_assert         (_mbim_message_fragment_collector_complete (message) == FALSE);
+
     g_byte_array_remove_range (bytearray, 0, mbim_message_get_message_length ((const MbimMessage *)bytearray));
+    g_assert (mbim_message_validate ((const MbimMessage *)bytearray, &error));
+    g_assert_no_error (error);
 
     /* Add fourth fragment */
     g_assert (_mbim_message_fragment_collector_add (message, (const MbimMessage *)bytearray, &error));
@@ -141,14 +162,16 @@ test_fragment_receive_multiple (void)
     g_assert_cmpuint (_mbim_message_fragment_get_current (message), ==, 0);
     g_byte_array_remove_range (bytearray, 0, mbim_message_get_message_length ((const MbimMessage *)bytearray));
 
-    /* Compare all compiled data */
+    /* Validate all compiled data */
+
+    g_assert (mbim_message_validate (message, &error));
+    g_assert_no_error (error);
+
     fragment_information_buffer = (_mbim_message_fragment_get_payload (
                                        message,
                                        &fragment_information_buffer_length));
     g_assert_cmpuint (fragment_information_buffer_length, ==, sizeof (data));
     g_assert (memcmp (fragment_information_buffer, data, fragment_information_buffer_length) == 0);
-
-    mbim_message_unref (message);
 }
 
 static void