==20365== Invalid read of size 8
==20365== at 0x4B3501: sim_fs_free (simfs.c:114)
==20365== by 0x493CEC: sim_remove (sim.c:2485)
==20365== by 0x4703D7: modem_change_state (modem.c:410)
==20365== by 0x470664: set_powered (modem.c:848)
==20365== by 0x4706BA: __ofono_modem_shutdown (modem.c:2137)
==20365== by 0x46F2C5: signal_cb (main.c:76)
==20365== by 0x52F555E: g_io_unix_dispatch (giounix.c:166)
==20365== by 0x52A0AAB: g_main_dispatch (gmain.c:2440)
==20365== by 0x52A203B: g_main_context_dispatch (gmain.c:3013)
==20365== by 0x52A2501: g_main_context_iterate (gmain.c:3091)
==20365== by 0x52A2C98: g_main_loop_run (gmain.c:3299)
==20365== by 0x46F0D3: main (main.c:243)
==20365== Address 0x63ff998 is 8 bytes inside a block of size 16 free'd
==20365== at 0x4C2612D: free (in
/usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
==20365== by 0x52AA4A1: g_free (gmem.c:263)
==20365== by 0x52C433D: g_slice_free1 (gslice.c:907)
==20365== by 0x52C58D0: g_slist_free_1 (gslist.c:192)
==20365== by 0x52C5C5F: g_slist_remove (gslist.c:465)
==20365== by 0x4B342A: sim_fs_context_free (simfs.c:192)
==20365== by 0x4B3500: sim_fs_free (simfs.c:117)
==20365== by 0x493CEC: sim_remove (sim.c:2485)
==20365== by 0x4703D7: modem_change_state (modem.c:410)
==20365== by 0x470664: set_powered (modem.c:848)
==20365== by 0x4706BA: __ofono_modem_shutdown (modem.c:2137)
==20365== by 0x46F2C5: signal_cb (main.c:76)
==20287== Invalid read of size 4
==20287== at 0x52B5C6B: g_queue_peek_nth_link (gqueue.c:704)
==20287== by 0x52B5F57: g_queue_peek_nth (gqueue.c:848)
==20287== by 0x4B33ED: sim_fs_context_free (simfs.c:170)
==20287== by 0x4B34F8: sim_fs_free (simfs.c:116)
==20287== by 0x493CEC: sim_remove (sim.c:2485)
==20287== by 0x4703D7: modem_change_state (modem.c:410)
==20287== by 0x470664: set_powered (modem.c:848)
==20287== by 0x4706BA: __ofono_modem_shutdown (modem.c:2137)
==20287== by 0x46F2C5: signal_cb (main.c:76)
==20287== by 0x52F555E: g_io_unix_dispatch (giounix.c:166)
==20287== by 0x52A0AAB: g_main_dispatch (gmain.c:2440)
==20287== by 0x52A203B: g_main_context_dispatch (gmain.c:3013)
==20287== Address 0x63fae70 is 16 bytes inside a block of size 24
free'd
==20287== at 0x4C2612D: free (in
/usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
==20287== by 0x52AA4A1: g_free (gmem.c:263)
==20287== by 0x52C433D: g_slice_free1 (gslice.c:907)
==20287== by 0x52B4E96: g_queue_free (gqueue.c:60)
==20287== by 0x4B34E0: sim_fs_free (simfs.c:107)
==20287== by 0x493CEC: sim_remove (sim.c:2485)
==20287== by 0x4703D7: modem_change_state (modem.c:410)
==20287== by 0x470664: set_powered (modem.c:848)
==20287== by 0x4706BA: __ofono_modem_shutdown (modem.c:2137)
==20287== by 0x46F2C5: signal_cb (main.c:76)
==20287== by 0x52F555E: g_io_unix_dispatch (giounix.c:166)
==20287== by 0x52A0AAB: g_main_dispatch (gmain.c:2440)
In certain circumstances, when the image has been cached but EFimg has
not been read yet, we might end up accessing an unitialized variable.
Fix this by always failing if EFimg has not been read yet.