[arch-commits] Commit in modem-manager-gui/trunk (PKGBUILD fix-crash.patch)

[Balló György]

    Date: Friday, March 29, 2019 @ 11:07:52
  Author: bgyorgy
Revision: 445984

upgpkg: modem-manager-gui 0.0.19.1-3

Fix crash (FS#61622, FS#61823)

Added:
  modem-manager-gui/trunk/fix-crash.patch
Modified:
  modem-manager-gui/trunk/PKGBUILD

-----------------+
 PKGBUILD        |    8 ++++
 fix-crash.patch |   88 ++++++++++++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 95 insertions(+), 1 deletion(-)

Modified: PKGBUILD
===================================================================
--- PKGBUILD	2019-03-29 11:02:45 UTC (rev 445983)
+++ PKGBUILD	2019-03-29 11:07:52 UTC (rev 445984)
@@ -3,7 +3,7 @@
 
 pkgname=modem-manager-gui
 pkgver=0.0.19.1
-pkgrel=2
+pkgrel=3
 pkgdesc="Frontend for ModemManager daemon able to control specific modem functions"
 arch=('x86_64')
 url="https://linuxonly.ru/page/modem-manager-gui"
@@ -13,12 +13,18 @@
 optdepends=('networkmanager: monitor network traffic')
 options=(!emptydirs)
 source=("https://download.tuxfamily.org/gsf/source/$pkgname-$pkgver.tar.gz"
+        fix-crash.patch
         no-indicator.patch)
 sha256sums=('0b9bae29f3cd3d99b3a61d5530097d576a5fa67d3215d54f3570cb20c6ca0bc2'
+            'b690023687614a04206ddecd684224350b75e70599e693703e777dab3412e655'
             '04f85c3d6e7dbf89f5767446a1884f1f45aaea4023a8d07981b819be181849b3')
 
 prepare() {
   cd $pkgname-$pkgver
+
+  # Fix memory corruption because of wrong strsep() usage (FS#61622, FS#61823)
+  patch -Np1 -i ../fix-crash.patch
+
   # Revert to GTK+ status icon
   patch -Np1 -i ../no-indicator.patch
 }

Added: fix-crash.patch
===================================================================
--- fix-crash.patch	                        (rev 0)
+++ fix-crash.patch	2019-03-29 11:07:52 UTC (rev 445984)
@@ -0,0 +1,88 @@
+# HG changeset patch
+# User Alex <alex at linuxonly.ru>
+# Date 1550936745 -10800
+# Node ID 6710bf86869852bb8a9946b628eff5bc1019b5aa
+# Parent  e8a146d4d2ea8525301670fb48b1accfdde13ac9
+Fix memory corruption because of wrong strsep() usage (Thanks to Persmule)
+
+diff --git a/src/modules/mm06.c b/src/modules/mm06.c
+--- a/src/modules/mm06.c
++++ b/src/modules/mm06.c
+@@ -1552,10 +1552,12 @@
+ 	GVariantIter *iter;
+ 	guint32 locationtype;
+ 	GVariant *locationdata;
+-	gchar *locationstring;
+ 	gsize strlength;
++	gchar **fragments;
++	gint i;
+ 	GError *error;
+-			
++	const gint numbases[4] = {10, 10, 16, 16};
++	
+ 	if ((mmguicore == NULL) || (device == NULL)) return FALSE;
+ 	mmguicorelc = (mmguicore_t)mmguicore;
+ 	
+@@ -1578,14 +1580,17 @@
+ 		g_variant_get(data, "(a{uv})", &iter);
+ 		while (g_variant_iter_next(iter, "{uv}", &locationtype, &locationdata)) {
+ 			if ((locationtype == MODULE_INT_MODEM_LOCATION_CAPABILITY_GSM_LAC_CI) && (locationdata != NULL)) {
+-				//3GPP location
++				/*3GPP location*/
+ 				strlength = 256;
+-				locationstring = g_strdup(g_variant_get_string(locationdata, &strlength));
+-				device->loc3gppdata[0] = (guint)strtol(strsep(&locationstring, ","), NULL, 10);
+-				device->loc3gppdata[1] = (guint)strtol(strsep(&locationstring, ","), NULL, 10);
+-				device->loc3gppdata[2] = (guint)strtol(strsep(&locationstring, ","), NULL, 16);
+-				device->loc3gppdata[3] = (guint)strtol(strsep(&locationstring, ","), NULL, 16);
+-				g_free(locationstring);
++				fragments = g_strsplit(g_variant_get_string(locationdata, &strlength), ",", 4);
++				if (fragments != NULL) {
++					i = 0;
++					while ((fragments[i] != NULL) && (i < 4)) {
++						device->loc3gppdata[i] = (guint)strtoul(fragments[i], NULL, numbases[i]);
++						i++;
++					}
++					g_strfreev(fragments);
++				}
+ 				g_variant_unref(locationdata);
+ 				g_debug("3GPP location: %u, %u, %4x, %4x", device->loc3gppdata[0], device->loc3gppdata[1], device->loc3gppdata[2], device->loc3gppdata[3]);
+ 			}
+diff --git a/src/modules/mm07.c b/src/modules/mm07.c
+--- a/src/modules/mm07.c
++++ b/src/modules/mm07.c
+@@ -1659,8 +1659,11 @@
+ 	GVariant *locationdata;
+ 	gchar *locationstring;
+ 	gsize strlength;
++	gchar **fragments;
++	gint i;
+ 	GError *error;
+-			
++	const gint numbases[4] = {10, 10, 16, 16};
++	
+ 	if ((mmguicore == NULL) || (device == NULL)) return FALSE;
+ 	mmguicorelc = (mmguicore_t)mmguicore;
+ 	
+@@ -1684,12 +1687,15 @@
+ 			if ((locationtype == MODULE_INT_MODEM_LOCATION_SOURCE_3GPP_LAC_CI) && (locationdata != NULL)) {
+ 				/*3GPP location*/
+ 				strlength = 256;
+-				locationstring = g_strdup(g_variant_get_string(locationdata, &strlength));
+-				device->loc3gppdata[0] = (guint)strtol(strsep(&locationstring, ","), NULL, 10);
+-				device->loc3gppdata[1] = (guint)strtol(strsep(&locationstring, ","), NULL, 10);
+-				device->loc3gppdata[2] = (guint)strtol(strsep(&locationstring, ","), NULL, 16);
+-				device->loc3gppdata[3] = (guint)strtol(strsep(&locationstring, ","), NULL, 16);
+-				g_free(locationstring);
++				fragments = g_strsplit(g_variant_get_string(locationdata, &strlength), ",", 4);
++				if (fragments != NULL) {
++					i = 0;
++					while ((fragments[i] != NULL) && (i < 4)) {
++						device->loc3gppdata[i] = (guint)strtoul(fragments[i], NULL, numbases[i]);
++						i++;
++					}
++					g_strfreev(fragments);
++				}
+ 				g_variant_unref(locationdata);
+ 				g_debug("3GPP location: %u, %u, %4x, %4x\n", device->loc3gppdata[0], device->loc3gppdata[1], device->loc3gppdata[2], device->loc3gppdata[3]);
+ 			} else if ((locationtype == MODULE_INT_MODEM_LOCATION_SOURCE_GPS_RAW) && (locationdata != NULL)) {