Age | Commit message (Collapse) | Author | Files | Lines |
|
In PPP Protocol-Reject package the 'rejected data field' should be a copy
of the rejected package, the copy starts from the data field. besides,
Protocol-Reject package include a 'rejected protocol field', it is the
same as the protocol field of the rejected package.
Protocol-Reject package structure is:
| PPP_header | rejected protocol | rejected data
The rejected package structure is:
| Addr | Control | protocol | data
So the Protocol-Reject package data field is copied from the 3rd byte of
the rejected package.
|
|
==20365== Invalid read of size 8
==20365== at 0x4B3501: sim_fs_free (simfs.c:114)
==20365== by 0x493CEC: sim_remove (sim.c:2485)
==20365== by 0x4703D7: modem_change_state (modem.c:410)
==20365== by 0x470664: set_powered (modem.c:848)
==20365== by 0x4706BA: __ofono_modem_shutdown (modem.c:2137)
==20365== by 0x46F2C5: signal_cb (main.c:76)
==20365== by 0x52F555E: g_io_unix_dispatch (giounix.c:166)
==20365== by 0x52A0AAB: g_main_dispatch (gmain.c:2440)
==20365== by 0x52A203B: g_main_context_dispatch (gmain.c:3013)
==20365== by 0x52A2501: g_main_context_iterate (gmain.c:3091)
==20365== by 0x52A2C98: g_main_loop_run (gmain.c:3299)
==20365== by 0x46F0D3: main (main.c:243)
==20365== Address 0x63ff998 is 8 bytes inside a block of size 16 free'd
==20365== at 0x4C2612D: free (in
/usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
==20365== by 0x52AA4A1: g_free (gmem.c:263)
==20365== by 0x52C433D: g_slice_free1 (gslice.c:907)
==20365== by 0x52C58D0: g_slist_free_1 (gslist.c:192)
==20365== by 0x52C5C5F: g_slist_remove (gslist.c:465)
==20365== by 0x4B342A: sim_fs_context_free (simfs.c:192)
==20365== by 0x4B3500: sim_fs_free (simfs.c:117)
==20365== by 0x493CEC: sim_remove (sim.c:2485)
==20365== by 0x4703D7: modem_change_state (modem.c:410)
==20365== by 0x470664: set_powered (modem.c:848)
==20365== by 0x4706BA: __ofono_modem_shutdown (modem.c:2137)
==20365== by 0x46F2C5: signal_cb (main.c:76)
|
|
==20287== Invalid read of size 4
==20287== at 0x52B5C6B: g_queue_peek_nth_link (gqueue.c:704)
==20287== by 0x52B5F57: g_queue_peek_nth (gqueue.c:848)
==20287== by 0x4B33ED: sim_fs_context_free (simfs.c:170)
==20287== by 0x4B34F8: sim_fs_free (simfs.c:116)
==20287== by 0x493CEC: sim_remove (sim.c:2485)
==20287== by 0x4703D7: modem_change_state (modem.c:410)
==20287== by 0x470664: set_powered (modem.c:848)
==20287== by 0x4706BA: __ofono_modem_shutdown (modem.c:2137)
==20287== by 0x46F2C5: signal_cb (main.c:76)
==20287== by 0x52F555E: g_io_unix_dispatch (giounix.c:166)
==20287== by 0x52A0AAB: g_main_dispatch (gmain.c:2440)
==20287== by 0x52A203B: g_main_context_dispatch (gmain.c:3013)
==20287== Address 0x63fae70 is 16 bytes inside a block of size 24
free'd
==20287== at 0x4C2612D: free (in
/usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
==20287== by 0x52AA4A1: g_free (gmem.c:263)
==20287== by 0x52C433D: g_slice_free1 (gslice.c:907)
==20287== by 0x52B4E96: g_queue_free (gqueue.c:60)
==20287== by 0x4B34E0: sim_fs_free (simfs.c:107)
==20287== by 0x493CEC: sim_remove (sim.c:2485)
==20287== by 0x4703D7: modem_change_state (modem.c:410)
==20287== by 0x470664: set_powered (modem.c:848)
==20287== by 0x4706BA: __ofono_modem_shutdown (modem.c:2137)
==20287== by 0x46F2C5: signal_cb (main.c:76)
==20287== by 0x52F555E: g_io_unix_dispatch (giounix.c:166)
==20287== by 0x52A0AAB: g_main_dispatch (gmain.c:2440)
|
|
|
|
This fixes an invalid access condition for the case where the
gprs atom is destroyed before context atoms are.
|
|
|
|
|
|
This uncovers a valgrind condition:
==17231== Invalid read of size 8
==17231== at 0x4A2461: gprs_context_unregister (gprs.c:2143)
==17231== by 0x46FEB0: __ofono_atom_unregister (modem.c:260)
==17231== by 0x4703C9: modem_change_state (modem.c:407)
==17231== by 0x470664: set_powered (modem.c:848)
==17231== by 0x4706BA: __ofono_modem_shutdown (modem.c:2137)
|
|
|
|
In certain circumstances, when the image has been cached but EFimg has
not been read yet, we might end up accessing an unitialized variable.
Fix this by always failing if EFimg has not been read yet.
|
|
|
|
|
|
Resulting from the client sending '+++' escape sequence.
|
|
In situations where the PPP stream can be suspended by the peer, e.g. in
the server role using '+++'
|
|
|
|
|
|
|
|
|
|
The list itself needs to be freed as well and not only its elements.
|
|
Fix a gcc 4.5.2 warning uninit var
|
|
|
|
In addition, fix ordering and make sure that lower case 'x' is used
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Remove a debug information, since the info is useless, and more,
it can display invalid info due to var not initialise in some case
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Don't create the gprs atom if the modem device was not opened
successfully. Otherwise ofonod will crash.
|
|
In case of offline modem when GPRS data connection is connected, if gprs
atom is removed before PPP termination process is complete, the terminate_timer
will not be stop. It will cause ofonod crash when the timer times out.
|
|
Fix precedence between waiting and dialing so HFP emulator is notified
of dialing/alerting even in case of a waiting call pending.
|
|
|
|
|
|
|