diff options
author | Aleksander Morgado <aleksandermj@chromium.org> | 2022-09-27 13:53:20 +0200 |
---|---|---|
committer | Aleksander Morgado <aleksandermj@chromium.org> | 2022-09-27 13:54:06 +0200 |
commit | d3baf0c492e954cf75024da71dfaac222278c0b4 (patch) | |
tree | e62c9d8b37a8925a6bffeab9ec11692aa8b1cd23 | |
parent | 18ac2105b9a806dc3497428124a5a3d6ceb99fd4 (diff) | |
download | libqmi-d3baf0c492e954cf75024da71dfaac222278c0b4.tar.gz |
libqmi-glib,compat: fix invalid memory read on slot EID loading
This issue affects ModemManager 1.18 running against libqmi from the
git main branch.
==87057== Invalid read of size 4
==87057== at 0x5017285: g_array_maybe_expand (garray.c:988)
==87057== by 0x50176EF: g_array_append_vals (garray.c:528)
==87057== by 0x4A5ECF6: qmi_message_uim_get_slot_status_output_get_slot_eid_information (qmi-compat.c:2410)
==87057== by 0x2028AC: uim_get_slot_status_ready (mm-shared-qmi.c:3268)
==87057== by 0x4E6BD63: g_task_return_now (gtask.c:1232)
==87057== by 0x4E6FA1C: UnknownInlinedFun (gtask.c:1301)
==87057== by 0x4E6FA1C: g_task_return (gtask.c:1258)
==87057== by 0x4B65956: get_slot_status_ready (qmi-uim.c:22339)
==87057== by 0x4E58522: g_simple_async_result_complete (gsimpleasyncresult.c:804)
==87057== by 0x4E585AD: complete_in_idle_cb (gsimpleasyncresult.c:816)
==87057== by 0x504A81A: UnknownInlinedFun (gmain.c:3444)
==87057== by 0x504A81A: g_main_context_dispatch (gmain.c:4162)
==87057== by 0x50A0EC8: g_main_context_iterate.constprop.0 (gmain.c:4238)
==87057== by 0x5049D7E: g_main_loop_run (gmain.c:4438)
==87057== Address 0x9058870 is 16 bytes inside a block of size 40 free'd
==87057== at 0x484426F: free (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==87057== by 0x5014405: array_free (garray.c:486)
==87057== by 0x4A5ECB7: message_uim_get_slot_status_output_clear_slot_eid_information (qmi-compat.c:2358)
==87057== by 0x4A5ECB7: qmi_message_uim_get_slot_status_output_get_slot_eid_information (qmi-compat.c:2402)
==87057== by 0x2028AC: uim_get_slot_status_ready (mm-shared-qmi.c:3268)
==87057== by 0x4E6BD63: g_task_return_now (gtask.c:1232)
==87057== by 0x4E6FA1C: UnknownInlinedFun (gtask.c:1301)
==87057== by 0x4E6FA1C: g_task_return (gtask.c:1258)
==87057== by 0x4B65956: get_slot_status_ready (qmi-uim.c:22339)
==87057== by 0x4E58522: g_simple_async_result_complete (gsimpleasyncresult.c:804)
==87057== by 0x4E585AD: complete_in_idle_cb (gsimpleasyncresult.c:816)
==87057== by 0x504A81A: UnknownInlinedFun (gmain.c:3444)
==87057== by 0x504A81A: g_main_context_dispatch (gmain.c:4162)
==87057== by 0x50A0EC8: g_main_context_iterate.constprop.0 (gmain.c:4238)
==87057== by 0x5049D7E: g_main_loop_run (gmain.c:4438)
==87057== Block was alloc'd at
==87057== at 0x4841888: malloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==87057== by 0x50482C9: g_malloc (gmem.c:130)
==87057== by 0x506AD17: g_slice_alloc (gslice.c:1074)
==87057== by 0x5017435: g_array_sized_new (garray.c:273)
==87057== by 0x4A5EC7D: qmi_message_uim_get_slot_status_output_get_slot_eid_information (qmi-compat.c:2399)
==87057== by 0x2028AC: uim_get_slot_status_ready (mm-shared-qmi.c:3268)
==87057== by 0x4E6BD63: g_task_return_now (gtask.c:1232)
==87057== by 0x4E6FA1C: UnknownInlinedFun (gtask.c:1301)
==87057== by 0x4E6FA1C: g_task_return (gtask.c:1258)
==87057== by 0x4B65956: get_slot_status_ready (qmi-uim.c:22339)
==87057== by 0x4E58522: g_simple_async_result_complete (gsimpleasyncresult.c:804)
==87057== by 0x4E585AD: complete_in_idle_cb (gsimpleasyncresult.c:816)
==87057== by 0x504A81A: UnknownInlinedFun (gmain.c:3444)
==87057== by 0x504A81A: g_main_context_dispatch (gmain.c:4162)
-rw-r--r-- | src/libqmi-glib/qmi-compat.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/src/libqmi-glib/qmi-compat.c b/src/libqmi-glib/qmi-compat.c index b543a4a0..9eb58340 100644 --- a/src/libqmi-glib/qmi-compat.c +++ b/src/libqmi-glib/qmi-compat.c @@ -2396,10 +2396,10 @@ qmi_message_uim_get_slot_status_output_get_slot_eid_information ( guint i; ctx = message_uim_get_slot_status_output_get_compat_context (self); - ctx->slot_eid_information = g_array_sized_new (FALSE, FALSE, sizeof (GArray *), slot_eid->len); if (ctx->slot_eid_information) message_uim_get_slot_status_output_clear_slot_eid_information (ctx->slot_eid_information); + ctx->slot_eid_information = g_array_sized_new (FALSE, FALSE, sizeof (GArray *), slot_eid->len); for (i = 0; i < slot_eid->len; i++) { QmiSlotEidElement *element; |