diff options
| author | Andrzej Zaborowski <andrew.zaborowski@intel.com> | 2009-10-16 19:44:36 +0200 |
|---|---|---|
| committer | Denis Kenzior <denkenz@gmail.com> | 2009-10-16 11:09:42 -0500 |
| commit | e6b8550328677a45a6f5772d8523d8c876a12ca3 (patch) | |
| tree | d39b1592f6d7bb0df95cf01d0644f2e417bc54b6 | |
| parent | c6f4a39ab787d269a31d1dfa45cab87a311a2be2 (diff) | |
| download | ofono-e6b8550328677a45a6f5772d8523d8c876a12ca3.tar.bz2 | |
Fix: Free converted string after use.
Also make sure we don't read beyond end of the string.
| -rw-r--r-- | drivers/atmodem/ussd.c | 10 |
1 files changed, 8 insertions, 2 deletions
diff --git a/drivers/atmodem/ussd.c b/drivers/atmodem/ussd.c index c29f8f69..d1874b92 100644 --- a/drivers/atmodem/ussd.c +++ b/drivers/atmodem/ussd.c @@ -59,7 +59,7 @@ static void at_ussd_request(struct ofono_ussd *ussd, const char *str, { GAtChat *chat = ofono_ussd_get_data(ussd); struct cb_data *cbd = cb_data_new(cb, data); - unsigned char *converted; + unsigned char *converted = NULL; int dcs; int max_len; long written; @@ -83,7 +83,10 @@ static void at_ussd_request(struct ofono_ussd *ussd, const char *str, if (written > max_len) goto error; - sprintf(buf, "AT+CUSD=1,\"%s\",%d", converted, dcs); + sprintf(buf, "AT+CUSD=1,\"%*s\",%d", (int) written, converted, dcs); + + g_free(converted); + converted = NULL; if (g_at_chat_send(chat, buf, none_prefix, cusd_request_cb, cbd, g_free) > 0) @@ -93,6 +96,9 @@ error: if (cbd) g_free(cbd); + if (converted) + g_free(converted); + CALLBACK_WITH_FAILURE(cb, data); } |