[emulator/rilmodem] Crash reading EFmsisdn file

[Tony Espy]

While working on the testing ofono using the touch emulator, I ran into an ofono crash while trying to read the EFmsisdn file.

The crash occurs using a package build from the following branch:

https://code.launchpad.net/~phablet-team/ofono/rilmodem-power-ussd

Note, you need to manually power on the modem for the crash to occur using the ofono-script 'online-modem'.

The actual crash is in the core ofono function sim_adn_parse() in smsutil.c. The crash is caused because RIL returns the following a response with a NULL third parameter, and the grilreply code doesn't handle this explicitly, so the reply member hex_respponse isn't set, and thus is returned as garbage to the core code:

[0024]> RIL_REQUEST_SIM_IO (cmd=0xC0,efid=0x6F40,path=3F007F10,1,4,32,(null),pin2=(null),aid=(null))
[0024]< RIL_REQUEST_SIM_IO (sw1=0x67,sw2=0x00,(null))

[Tony Espy (awe)]

Pull requested created:

https://github.com/rilmodem/ofono/pull/44

[Launchpad Janitor (janitor)]

This bug was fixed in the package ofono - 1.12+bzr6856-0ubuntu1

---------------
ofono (1.12+bzr6856-0ubuntu1) trusty; urgency=low

  [ Tony Espy ]
  * unit: fix fail-to-build on powerpc
    The previously released version enabled -Wall,
    which triggered build failures due to unused
    functions on powerpc. This is due to the fact
    that the unit tests only run on LITTLE_ENDIAN
    systems via an ifdef, which leaves unused functions
    and data. This change exends the ifdef to cover
    the unused functions and test data.
  * idmap: use UL for bitshift literals (LP: #1271284)
    This change fixes a failing unit test on ppc64le
    due to the undefined behavior when the left bitshift
    operator is given a value that excedes the size of
    the value being shifted.
  * gril, rilmodem/sim, unit: fix SIM IO crash (LP: #1268743)
    - cleanup gril_reply_parse_sim_io() to add malformed parcel
      check and fix memory leak.
    - add check for null hex_response in ril_file_io_cb(), as
      the emulator can return such responses.
    - add additional unit tests to cover crash scenarios.
  * ril, src: enable message-waiting-interface
    - register message_waiting atom in ril plugin
    - register message_waiting atom in ril plugin
    - fix sms_mwi_dcs_decode bug which prevented incoming message
      waiting indications from being set.
  * rilmodem/voicecall: fix call-decline bug (LP: #1260988)
    Send a RIL_REQUEST_HANGUP_WAITING_OR_BACKGROUND instead of
    was used correctly for displaying operator name, however
    some modems failed to handle roaming correctly for MVNOs.
    This fix is transparent to modems that do the right thing.
  * gril/gril.c, plugins/ril.c: API changes for OEMS
    This change introduces a socket-path to the g_ril_new()
    function, and also adds a new disconnect function.
  * gril/grilunsol.c: add support for v5 signal strength message
  * debian/control: adjust ofono-scripts dependencies for Python 3
  * test/rilmodem: add copyright/license headers

  [ Martin Pitt ]
  * test: convert tests scripts to Python 3 (LP: #1283571)
 -- Ricardo Salveti de Araujo <email address hidden> Fri, 28 Feb 2014 17:50:54 -0300