Bug 65166 - Segfault when parsing Subscriber Ready Status response
Summary: Segfault when parsing Subscriber Ready Status response
Status: RESOLVED FIXED
Alias: None
Product: libmbim
Classification: Unclassified
Component: General (show other bugs)
Version: unspecified
Hardware: Other All
: medium normal
Assignee: Aleksander Morgado
QA Contact:
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2013-05-30 08:41 UTC by Aleksander Morgado
Modified: 2013-05-30 11:04 UTC (History)
0 users

See Also:
i915 platform:
i915 features:


Attachments

Description Aleksander Morgado 2013-05-30 08:41:32 UTC
Program received signal SIGSEGV, Segmentation fault.
0x00007ffff6d7dc68 in __gconv () from /usr/lib/libc.so.6
(gdb) bt
#0  0x00007ffff6d7dc68 in __gconv () from /usr/lib/libc.so.6
#1  0x00007ffff6d7d209 in iconv () from /usr/lib/libc.so.6
#2  0x00007ffff7134255 in g_convert_with_iconv () from /usr/lib/libglib-2.0.so.0
#3  0x00007ffff7134498 in g_convert () from /usr/lib/libglib-2.0.so.0
#4  0x00007ffff7bc541a in _mbim_message_read_string_array
(self=self@entry=0x63ba40, array_size=<optimized out>,
relative_offset_array_start=relative_offset_array_start@entry=28) at
mbim-message.c:233
#5  0x00007ffff7bccc8c in
mbim_message_subscriber_ready_status_response_parse
(message=message@entry=0x63ba40,
ready_state=ready_state@entry=0x7fffffffe734,
subscriber_id=subscriber_id@entry=0x7fffffffe748,
    sim_icc_id=sim_icc_id@entry=0x7fffffffe750,
ready_info=ready_info@entry=0x7fffffffe738,
telephone_numbers_count=telephone_numbers_count@entry=0x7fffffffe73c,
telephone_numbers=telephone_numbers@entry=0x7fffffffe758,
    error=error@entry=0x7fffffffe740) at mbim-basic-connect.c:1211
#6  0x0000000000403e94 in query_subscriber_ready_status_ready
(device=0x640840, res=<optimized out>) at mbimcli-basic-connect.c:342
#7  0x00007ffff78caac7 in g_simple_async_result_complete () from
/usr/lib/libgio-2.0.so.0
#8  0x00007ffff78cab29 in ?? () from /usr/lib/libgio-2.0.so.0
#9  0x00007ffff714fe46 in g_main_context_dispatch () from
/usr/lib/libglib-2.0.so.0
#10 0x00007ffff7150198 in ?? () from /usr/lib/libglib-2.0.so.0
#11 0x00007ffff715059a in g_main_loop_run () from /usr/lib/libglib-2.0.so.0
#12 0x0000000000402c46 in main (argc=1, argv=0x7fffffffe9e8) at mbimcli.c:336


The culprit seems to be this response:

03:00:00:80:B4:00:00:00:02:00:00:00:01:00:00:00:00:00:00:00:A2:89:CC:33:BC:BB:8B:4F:B6:B0:13:3E:C2:AA:E6:DF:02:00:00:00:00:00:00:00:84:00:00:00:01:00:00:00:3C:00:00:00:1E:00:00:00:5C:00:00:00:28:00:00:00:00:00:00:00:01:00:00:00:24:00:00:00:16:00:00:00:31:00:38:00:31:00:33:00:39:00:39:00:32:00:33:00:35:00:38:00:35:00:00:00:33:00:31:00:30:00:34:00:31:00:30:00:34:00:36:00:39:00:31:00:31:00:30:00:37:00:36:00:31:00:00:00:38:00:39:00:30:00:31:00:34:00:31:00:30:00:34:00:32:00:35:00:34:00:36:00:39:00:31:00:31:00:30:00:37:00:36:00:31:00:32:00
Comment 1 Aleksander Morgado 2013-05-30 11:04:50 UTC
Should be fixed now in git master, commit c454956ea4c1e71aad401d2b77bfb06dc7561a1b.

Added also a unit test to cover the issue.


Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.