summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorNeels Hofmeyr <neels@hofmeyr.de>2019-10-05 05:16:29 +0200
committerNeels Hofmeyr <neels@hofmeyr.de>2019-10-05 05:16:29 +0200
commit28d23389681c9611fc9b4fac596d3cdeecff00bf (patch)
tree9aea6a1f0df9e33479b78716c9b2f59edd667f55
parentdc9df818f72992b1572e59a5fda96ad620268cdf (diff)
-rw-r--r--msc/MSC_Tests.ttcn40
1 files changed, 35 insertions, 5 deletions
diff --git a/msc/MSC_Tests.ttcn b/msc/MSC_Tests.ttcn
index 5aaf068..3041b18 100644
--- a/msc/MSC_Tests.ttcn
+++ b/msc/MSC_Tests.ttcn
@@ -5795,17 +5795,46 @@ testcase TC_lu_imsi_auth_tmsi_check_imei_early_err() runs on MTC_CT {
vc_conn.done;
}
+friend function f_tc_invalid_mgcp_crash(charstring id, BSC_ConnHdlrPars pars) runs on BSC_ConnHdlr {
+ f_init_handler(pars);
+ var CallParameters cpars := valueof(t_CallParams('12345'H, 0));
+ cpars.bss_rtp_port := 1110;
+ cpars.mgcp_connection_id_bss := '22222'H;
+ cpars.mgcp_connection_id_mss := '33333'H;
+ cpars.mgcp_ep := "rtpbridge/1@mgw";
+
+ /* Set invalid IP address so that osmo-msc discards the rtp_stream and MGCP endpoint FSM instances in the middle
+ * of successful MGCP response dispatch. If things aren't safeguarded, the on_success() in osmo_mgcpc_ep_fsm
+ * will cause a use-after-free after that event dispatch. */
+ cpars.mgw_rtp_ip_bss := "0.0.0.0";
+ cpars.mgw_rtp_ip_mss := "0.0.0.0";
+ cpars.rtp_sdp_format := "FOO/8000";
+
+ f_perform_lu();
+ f_mo_call(cpars);
+}
+testcase TC_invalid_mgcp_crash() runs on MTC_CT {
+ var BSC_ConnHdlr vc_conn;
+ f_init();
+
+ vc_conn := f_start_handler(refers(f_tc_invalid_mgcp_crash), 7);
+ vc_conn.done;
+}
+
+
control {
- //execute( TC_mo_setup_and_nothing() );
-// execute( TC_mo_crcx_ran_timeout() );
-// execute( TC_mo_crcx_ran_reject() );
-// execute( TC_mo_setup_and_dtmf_dup() );
+ /*
+ execute( TC_mo_setup_and_nothing() );
+ execute( TC_mo_crcx_ran_timeout() );
+ execute( TC_mo_crcx_ran_reject() );
+ execute( TC_mo_setup_and_dtmf_dup() );
execute( TC_mo_release_timeout() );
+ */
+ //execute( TC_lu_and_mt_call() );
/*
execute( TC_lu_and_mt_call_no_dlcx_resp() );
- execute( TC_lu_and_mt_call() );
execute( TC_lu_and_mo_ussd_during_mt_call() );
execute( TC_lu_and_mt_ussd_during_mt_call() );
@@ -5816,6 +5845,7 @@ control {
execute( TC_lu_and_mt_call_osmux() );
}
*/
+ execute( TC_invalid_mgcp_crash() );
}