[emulator/rilmodem] Crash reading EFmsisdn file

Bug #1268743 reported by Tony Espy on 2014-01-13
This bug affects 1 person
Affects Status Importance Assigned to Milestone
ofono (Ubuntu)
Tony Espy

Bug Description

While working on the testing ofono using the touch emulator, I ran into an ofono crash while trying to read the EFmsisdn file.

The crash occurs using a package build from the following branch:


Note, you need to manually power on the modem for the crash to occur using the ofono-script 'online-modem'.

The actual crash is in the core ofono function sim_adn_parse() in smsutil.c. The crash is caused because RIL returns the following a response with a NULL third parameter, and the grilreply code doesn't handle this explicitly, so the reply member hex_respponse isn't set, and thus is returned as garbage to the core code:

[0024]> RIL_REQUEST_SIM_IO (cmd=0xC0,efid=0x6F40,path=3F007F10,1,4,32,(null),pin2=(null),aid=(null))
[0024]< RIL_REQUEST_SIM_IO (sw1=0x67,sw2=0x00,(null))

Related branches

Tony Espy (awe) on 2014-01-13
Changed in ofono (Ubuntu):
status: New → In Progress
assignee: nobody → Tony Espy (awe)
importance: Undecided → Critical
Tony Espy (awe) wrote :
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package ofono - 1.12+bzr6856-0ubuntu1

ofono (1.12+bzr6856-0ubuntu1) trusty; urgency=low

  [ Tony Espy ]
  * unit: fix fail-to-build on powerpc
    The previously released version enabled -Wall,
    which triggered build failures due to unused
    functions on powerpc. This is due to the fact
    that the unit tests only run on LITTLE_ENDIAN
    systems via an ifdef, which leaves unused functions
    and data. This change exends the ifdef to cover
    the unused functions and test data.
  * idmap: use UL for bitshift literals (LP: #1271284)
    This change fixes a failing unit test on ppc64le
    due to the undefined behavior when the left bitshift
    operator is given a value that excedes the size of
    the value being shifted.
  * gril, rilmodem/sim, unit: fix SIM IO crash (LP: #1268743)
    - cleanup gril_reply_parse_sim_io() to add malformed parcel
      check and fix memory leak.
    - add check for null hex_response in ril_file_io_cb(), as
      the emulator can return such responses.
    - add additional unit tests to cover crash scenarios.
  * ril, src: enable message-waiting-interface
    - register message_waiting atom in ril plugin
    - register message_waiting atom in ril plugin
    - fix sms_mwi_dcs_decode bug which prevented incoming message
      waiting indications from being set.
  * rilmodem/voicecall: fix call-decline bug (LP: #1260988)
    was used correctly for displaying operator name, however
    some modems failed to handle roaming correctly for MVNOs.
    This fix is transparent to modems that do the right thing.
  * gril/gril.c, plugins/ril.c: API changes for OEMS
    This change introduces a socket-path to the g_ril_new()
    function, and also adds a new disconnect function.
  * gril/grilunsol.c: add support for v5 signal strength message
  * debian/control: adjust ofono-scripts dependencies for Python 3
  * test/rilmodem: add copyright/license headers

  [ Martin Pitt ]
  * test: convert tests scripts to Python 3 (LP: #1283571)
 -- Ricardo Salveti de Araujo <email address hidden> Fri, 28 Feb 2014 17:50:54 -0300

Changed in ofono (Ubuntu):
status: In Progress → Fix Released
To post a comment you must log in.
This report contains Public information  Edit
Everyone can see this information.

Other bug subscribers