From b1f4e981f4935bff1b198a24cf110a6e838e42a9 Mon Sep 17 00:00:00 2001 From: Denis Kenzior Date: Sun, 8 May 2011 23:27:17 -0500 Subject: sim: Fix potential use of uninitialized variable In certain circumstances, when the image has been cached but EFimg has not been read yet, we might end up accessing an unitialized variable. Fix this by always failing if EFimg has not been read yet. --- src/sim.c | 22 ++++++++-------------- 1 file changed, 8 insertions(+), 14 deletions(-) (limited to 'src/sim.c') diff --git a/src/sim.c b/src/sim.c index af7a715a..eb2c16c3 100644 --- a/src/sim.c +++ b/src/sim.c @@ -945,18 +945,15 @@ static void sim_get_image(struct ofono_sim *sim, unsigned char id, unsigned short iidf_offset; unsigned short iidf_len; - image = sim_fs_get_cached_image(sim->simfs, id); - - if (image != NULL) { - sim_get_image_cb(sim, id, image, FALSE); - goto watch; - } - - if (sim->efimg_length <= (id * 9)) { + if (sim->efimg_length <= id * 9) { sim_get_image_cb(sim, id, NULL, FALSE); return; } + image = sim_fs_get_cached_image(sim->simfs, id); + if (image != NULL) + sim_get_image_cb(sim, id, image, FALSE); + efimg = &sim->efimg[id * 9]; iidf_id = efimg[3] << 8 | efimg[4]; @@ -964,12 +961,9 @@ static void sim_get_image(struct ofono_sim *sim, unsigned char id, iidf_len = efimg[7] << 8 | efimg[8]; /* read the image data */ - ofono_sim_read_bytes(sim->context, iidf_id, iidf_offset, iidf_len, - sim_iidf_read_cb, sim); - -watch: - if (sim->efimg_length <= id * 9) - return; + if (image == NULL) + ofono_sim_read_bytes(sim->context, iidf_id, iidf_offset, + iidf_len, sim_iidf_read_cb, sim); if (sim->iidf_watch_ids[id] > 0) return; -- cgit v1.2.3