[Title] fix risky defects

[Desc.] modify vmodem/server/server_rx_call.c, server_rx_gprs.c, server_rx_network.c, server_rx_phonebook.c, server_rx_ss.c, server_tx_call.c

diff --git a/packaging/vmodemd-emul.spec b/packaging/vmodemd-emul.spec
index 8bc3890af41f9fc862c5343ae890330d14b4eed2..ab250ac851fcc551bdd428de92fd38cceeee07f7 100644 (file)
--- a/packaging/vmodemd-emul.spec
+++ b/packaging/vmodemd-emul.spec
@@ -1,6 +1,6 @@
 #git:slp/pkgs/v/vmodem-daemon-emulator
 Name: vmodemd-emul
-Version: 0.2.29
+Version: 0.2.30
 Release: 1
 Summary: Modem Emulator
 Group: System/ModemEmulator

diff --git a/vmodem/server/server_rx_call.c b/vmodem/server/server_rx_call.c
index 8dca6de15ba4a8bdc31601cb42319a31e07aba0c..a5551bc9ef54d2d52e35c12af429023880c1b0e0 100644 (file)
--- a/vmodem/server/server_rx_call.c
+++ b/vmodem/server/server_rx_call.c
@@ -101,6 +101,8 @@ int server_rx_call_originate_exec(void *ptr_data, int data_len )
        STATE next;
 
        number = malloc(MAX_GSM_DIALED_DIGITS_NUM);
+       if(!number)
+               return -1;
        TRACE(MSGL_VGSM_INFO, "\n");
        char* call_data = strchr((char*)p, 'D');
         char token[] = ";";
@@ -136,6 +138,8 @@ int server_rx_call_originate_exec(void *ptr_data, int data_len )
 
                oem_tx_call_gen_resp(AT_CME_ERR_OPER_NOT_ALLOWED);
        
+               if(number)
+                       free(number);
                return 1;
        }
        oem_tx_call_gen_resp(AT_GEN_ERR_NO_ERROR);
@@ -151,8 +155,10 @@ int server_rx_call_originate_exec(void *ptr_data, int data_len )
        data[0] = call_id;
        data[1] = call_type;
 
-       if(clir_status == GSM_CALL_CLIR_STATUS_INVOCATION)
-               num_len = 0;
+       // On this path, the condition "clir_status == GSM_CALL_CLIR_STATUS_INVOCATION" cannot be true.
+       // Because clir_status = GSM_CALL_STATUS_DIALING;
+       //if(clir_status == GSM_CALL_CLIR_STATUS_INVOCATION)
+       //      num_len = 0;
 
        data[2] = num_len;
        data[3] = clir_status;
@@ -189,6 +195,8 @@ int server_rx_call_originate_exec(void *ptr_data, int data_len )
                set_state_machine( next );
                send_msg();
        }
+       if(number)
+               free(number);
        return 1;
 }
 

diff --git a/vmodem/server/server_rx_gprs.c b/vmodem/server/server_rx_gprs.c
index 97d88e3ae6610935de5314877b23571f56b5bd3b..b9267cc5baee46628f60adc8b3f3981ca49c5af2 100644 (file)
--- a/vmodem/server/server_rx_gprs.c
+++ b/vmodem/server/server_rx_gprs.c
@@ -122,11 +122,15 @@ int server_rx_gprs_SetPSActDeact(void *ptr_data, int data_len )
                TAPIMessageInit(&packet);
 
                data = malloc(sizeof(char)*1);
+               if(!data)
+                       return 0;
                ret = strtok(tdata+1, TOKEN);
                if(ret)
                         data[0] = atoi(ret);  /* 0: stop, 1: start */
-                else 
+                else {
+                       free(data);
                         return 0;
+               }
 
                ret = strtok(NULL, TOKEN);
                if(ret)

diff --git a/vmodem/server/server_rx_network.c b/vmodem/server/server_rx_network.c
index 8fecd0769ad6351224fd69e3a2a64360f261ef97..cc49fc6de666fc36243fec2371dc9b889a3fa29c 100644 (file)
--- a/vmodem/server/server_rx_network.c
+++ b/vmodem/server/server_rx_network.c
@@ -62,6 +62,8 @@ int server_rx_net_plmn_list_get(void)
 
        len = 1+(plmn_list->num_record*10);
        data = malloc(len);
+       if(!data)
+               return 0;
 
        data[n++] = plmn_list->num_record; /* NUM_RECORD */
        sprintf(sndbuf, "%s", COPS);

diff --git a/vmodem/server/server_rx_phonebook.c b/vmodem/server/server_rx_phonebook.c
index 82f4eb38740e2d97ad990e2749055799694ef0bf..391c7de5dfc72b4f06db657aaee8baa23322bd0b 100644 (file)
--- a/vmodem/server/server_rx_phonebook.c
+++ b/vmodem/server/server_rx_phonebook.c
@@ -120,6 +120,8 @@ int server_rx_sim_pb_set_access_req(void* ptr_data, int data_len)
                        {
                                cnt++;//mode
                                pb= malloc(sizeof(PB));
+                               if(!pb)
+                                       return -1;
                                memset(pb,0,(sizeof(PB)));
                                add_len=p[cnt];
 
@@ -158,6 +160,8 @@ int server_rx_sim_pb_set_access_req(void* ptr_data, int data_len)
                        case 0x02://DELETE
                        {
                                pb= malloc(sizeof(PB));
+                               if(pb == NULL)
+                                       return -1;
                                memset(pb,0,(sizeof(PB)));
 
                                add_len=p[cnt];

diff --git a/vmodem/server/server_rx_ss.c b/vmodem/server/server_rx_ss.c
index 91aab571b8bfa47b7ecfa5589a6fc3deb3e9e18f..ba97ac55ba7e33b6d6c1ea9147e827f9d9db7883 100644 (file)
--- a/vmodem/server/server_rx_ss.c
+++ b/vmodem/server/server_rx_ss.c
@@ -199,6 +199,8 @@ int server_rx_ss_cf_set(int ss_mode, int type, int tel_class, int replyTime, int
        TAPIMessageInit(&packet);
 
        call_forwarding_entry_t * entry = malloc(sizeof(call_forwarding_entry_t));
+       if(!entry)
+               return -1;
        memset(entry, 0, sizeof(call_forwarding_entry_t));
 
        entry->ss_mode = ss_mode;
@@ -312,6 +314,8 @@ int server_rx_ss_cb_set(int cb_type, int ss_mode, int tel_class, char *passwd)
        int cb_pwd_fail_count = 0;
 
        call_barring_entry_t * entry =  malloc(sizeof(call_barring_entry_t));
+       if(!entry)
+               return -1;
        memset(entry, 0, sizeof(call_barring_entry_t));
 
        entry->type =cb_type;
@@ -446,6 +450,8 @@ int server_rx_ss_cb_set(int cb_type, int ss_mode, int tel_class, char *passwd)
 int server_rx_ss_cb_passwd_set(char* curr_passwd, char* new_passwd)
 {
        VGSM_DEBUG("\n");
+       if(!curr_passwd || !new_passwd)
+               return -1
 
        int gen_resp_err;
        LXT_MESSAGE packet;
@@ -490,7 +496,7 @@ int server_rx_ss_cb_passwd_set(char* curr_passwd, char* new_passwd)
        packet.data = new_passwd;
        packet.group  = GSM_SUPS;
        packet.action = GSM_SUPS_PWDSET_CB_REQ;
-       packet.length = sizeof(new_passwd);
+       packet.length = strlen(new_passwd);
 
        VGSM_DEBUG("CallBarring Passwd changed\n");
 

diff --git a/vmodem/server/server_tx_call.c b/vmodem/server/server_tx_call.c
index 7b6ea9d394eca3dbb1c18be32930cf55c1d1881a..1711f4dd74c03dc59b78d20f86ff181d971e3279 100644 (file)
--- a/vmodem/server/server_tx_call.c
+++ b/vmodem/server/server_tx_call.c
@@ -87,6 +87,8 @@ int server_tx_call_status(void) // it means call state.
 
        LXT_MESSAGE packet;
        gsm_call_list_t * callList = malloc(sizeof(gsm_call_list_t));
+       if(!callList)
+               return -1;
 
        get_prev_state_machine( &prev );
 
@@ -158,7 +160,7 @@ int server_tx_call_status(void) // it means call state.
        int at_stat = change_stat_for_at(callList->CallInfo[get_call_id()].stat);
        TRACE(MSGL_VGSM_INFO, "call id:%d, orignal stat: %d, send stat: %d\n", get_call_id(), callList->CallInfo[get_call_id()].stat, at_stat);
        
-       if(callList->CallInfo[get_call_id()].number)
+       if(strcmp(callList->CallInfo[get_call_id()].number, ""))
        {
                sprintf((char*)pdata, "%d,%d,%d,%d,%d,%s,%d", get_call_id() + 1, change_dir_for_at(callList->CallInfo[get_call_id()].dir), 
                                                                at_stat, AT_CALL_MODE_VOICE, AT_CALL_MPTY_FALSE,