diff options
| author | Aleksander Morgado <aleksandermj@chromium.org> | 2022-11-22 13:43:12 +0000 |
|---|---|---|
| committer | Aleksander Morgado <aleksander@aleksander.es> | 2023-02-17 10:43:20 +0000 |
| commit | 5c5126b7ffdeb4dfbb7d6af47b136db1052a2a38 (patch) | |
| tree | ebd9e37ea1bdfeec4b8d5cdd6e81ef56e754e3d8 /src | |
| parent | d1ed6114a85d8434810567a894fa99ce8c7d0d2d (diff) | |
broadband-modem-mbim: avoid using already freed element during iteration
If we remove the current element being iterated in the GList, we can
no longer call g_list_next() on it. Ensure we keep a valid pointer to
the next element in the list before removing the current one.
Diffstat (limited to 'src')
| -rw-r--r-- | src/mm-broadband-modem-mbim.c | 10 |
1 files changed, 8 insertions, 2 deletions
diff --git a/src/mm-broadband-modem-mbim.c b/src/mm-broadband-modem-mbim.c index a255b588..baaa5353 100644 --- a/src/mm-broadband-modem-mbim.c +++ b/src/mm-broadband-modem-mbim.c @@ -2608,6 +2608,7 @@ base_stations_info_query_ready (MbimDevice *device, if (lte_serving_cell) { GList *l; + GList *next; info = mm_cell_info_lte_new_from_dictionary (NULL); mm_cell_info_set_serving (info, TRUE); @@ -2622,9 +2623,11 @@ base_stations_info_query_ready (MbimDevice *device, CELL_INFO_SET_UINT (lte_serving_cell->timing_advance, 0xFFFFFFFF, lte_set_timing_advance, MM_CELL_INFO_LTE); /* Update cell info with the radio frequency information received previously */ - for (l = ctx->rfim_info_list; l; l = g_list_next (l)) { + for (l = ctx->rfim_info_list, next = NULL; l; l = next) { MMRfInfo *data; + next = g_list_next (l); + data = (MMRfInfo *)(l->data); if (fabs ((mm_get_downlink_carrier_frequency (lte_serving_cell->earfcn, self)) - data->center_frequency) < FREQUENCY_TOLERENCE) { mm_obj_dbg (self, "Merging radio frequency data with lte serving cell info"); @@ -2678,6 +2681,7 @@ base_stations_info_query_ready (MbimDevice *device, for (i = 0; i < nr_serving_cells_count; i++) { GList *l; + GList *next; info = mm_cell_info_nr5g_new_from_dictionary (NULL); mm_cell_info_set_serving (info, TRUE); @@ -2693,9 +2697,11 @@ base_stations_info_query_ready (MbimDevice *device, CELL_INFO_SET_UINT (nr_serving_cells[i]->timing_advance, 0xFFFFFFFFFFFFFFFF, nr5g_set_timing_advance, MM_CELL_INFO_NR5G); /* Update cell info with the radio frequency information received previously */ - for (l = ctx->rfim_info_list; l; l = g_list_next (l)) { + for (l = ctx->rfim_info_list, next = NULL; l; l = next) { MMRfInfo *data; + next = g_list_next (l); + data = (MMRfInfo *)(l->data); /* Comparing the derived frequncy value from NRARFCN with received center frequency data to map the NR CELL */ if (fabs ((mm_get_frequency_from_nrarfcn (nr_serving_cells[i]->nrarfcn, self) * HERTZ_CONV) - data->center_frequency) < FREQUENCY_TOLERENCE) { |