| Summary: | Segfault when parsing Subscriber Ready Status response | ||
|---|---|---|---|
| Product: | libmbim | Reporter: | Aleksander Morgado <aleksander> |
| Component: | General | Assignee: | Aleksander Morgado <aleksander> |
| Status: | RESOLVED FIXED | QA Contact: | |
| Severity: | normal | ||
| Priority: | medium | ||
| Version: | unspecified | ||
| Hardware: | Other | ||
| OS: | All | ||
| Whiteboard: | |||
| i915 platform: | i915 features: | ||
Should be fixed now in git master, commit c454956ea4c1e71aad401d2b77bfb06dc7561a1b. Added also a unit test to cover the issue. |
Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.
Program received signal SIGSEGV, Segmentation fault. 0x00007ffff6d7dc68 in __gconv () from /usr/lib/libc.so.6 (gdb) bt #0 0x00007ffff6d7dc68 in __gconv () from /usr/lib/libc.so.6 #1 0x00007ffff6d7d209 in iconv () from /usr/lib/libc.so.6 #2 0x00007ffff7134255 in g_convert_with_iconv () from /usr/lib/libglib-2.0.so.0 #3 0x00007ffff7134498 in g_convert () from /usr/lib/libglib-2.0.so.0 #4 0x00007ffff7bc541a in _mbim_message_read_string_array (self=self@entry=0x63ba40, array_size=<optimized out>, relative_offset_array_start=relative_offset_array_start@entry=28) at mbim-message.c:233 #5 0x00007ffff7bccc8c in mbim_message_subscriber_ready_status_response_parse (message=message@entry=0x63ba40, ready_state=ready_state@entry=0x7fffffffe734, subscriber_id=subscriber_id@entry=0x7fffffffe748, sim_icc_id=sim_icc_id@entry=0x7fffffffe750, ready_info=ready_info@entry=0x7fffffffe738, telephone_numbers_count=telephone_numbers_count@entry=0x7fffffffe73c, telephone_numbers=telephone_numbers@entry=0x7fffffffe758, error=error@entry=0x7fffffffe740) at mbim-basic-connect.c:1211 #6 0x0000000000403e94 in query_subscriber_ready_status_ready (device=0x640840, res=<optimized out>) at mbimcli-basic-connect.c:342 #7 0x00007ffff78caac7 in g_simple_async_result_complete () from /usr/lib/libgio-2.0.so.0 #8 0x00007ffff78cab29 in ?? () from /usr/lib/libgio-2.0.so.0 #9 0x00007ffff714fe46 in g_main_context_dispatch () from /usr/lib/libglib-2.0.so.0 #10 0x00007ffff7150198 in ?? () from /usr/lib/libglib-2.0.so.0 #11 0x00007ffff715059a in g_main_loop_run () from /usr/lib/libglib-2.0.so.0 #12 0x0000000000402c46 in main (argc=1, argv=0x7fffffffe9e8) at mbimcli.c:336 The culprit seems to be this response: 03:00:00:80:B4:00:00:00:02:00:00:00:01:00:00:00:00:00:00:00:A2:89:CC:33:BC:BB:8B:4F:B6:B0:13:3E:C2:AA:E6:DF:02:00:00:00:00:00:00:00:84:00:00:00:01:00:00:00:3C:00:00:00:1E:00:00:00:5C:00:00:00:28:00:00:00:00:00:00:00:01:00:00:00:24:00:00:00:16:00:00:00:31:00:38:00:31:00:33:00:39:00:39:00:32:00:33:00:35:00:38:00:35:00:00:00:33:00:31:00:30:00:34:00:31:00:30:00:34:00:36:00:39:00:31:00:31:00:30:00:37:00:36:00:31:00:00:00:38:00:39:00:30:00:31:00:34:00:31:00:30:00:34:00:32:00:35:00:34:00:36:00:39:00:31:00:31:00:30:00:37:00:36:00:31:00:32:00