Change in osmo-msc[master]: libmsc/sms_queue.c: fix memleak in smsq_take_next_sms()

Vadim Yanitskiy gerrit-no-reply at
Thu Mar 28 15:00:40 UTC 2019

Vadim Yanitskiy has uploaded this change for review. (

Change subject: libmsc/sms_queue.c: fix memleak in smsq_take_next_sms()

libmsc/sms_queue.c: fix memleak in smsq_take_next_sms()

A memleak has been noticed after executing some of TTCN-3 test
cases. For example, the following ones:

  - MSC_Tests.TC_lu_and_mo_sms,
  - MSC_Tests.TC_lu_and_mt_sms.

The key point is that a test case basically disconnects too quick,
leaving some MT SMS messages (e.g. delivery reports) undelivered,
so they are getting stored in the SMSC's database.

As soon as the SMS queue is triggered, sms_submit_pending() would
retrieve pending messages from the database by calling function
smsq_take_next_sms() in loop.

This function in it's turn checks whether the subscriber is attached
or not. If not, the allocated 'gsm_sms' structure would not be
free()ed! Therefore, every time smsq_take_next_sms() is called,
a 'gsm_sms' structure for unattached subscriber is leaked.

Change-Id: Iad5e4d84d8d410ea43d5907e9ddf6e5fdb55bc7a
Closes: OS#3860
M src/libmsc/sms_queue.c
1 file changed, 6 insertions(+), 1 deletion(-)

  git pull ssh:// refs/changes/50/13450/1

diff --git a/src/libmsc/sms_queue.c b/src/libmsc/sms_queue.c
index c924dde..2987eba 100644
--- a/src/libmsc/sms_queue.c
+++ b/src/libmsc/sms_queue.c
@@ -226,8 +226,13 @@
 		osmo_strlcpy(last_msisdn, sms->dst.addr, last_msisdn_buflen);
 		/* Is the subscriber attached? If not, go to next SMS */
-		if (!sms->receiver || !sms->receiver->lu_complete)
+		if (!sms->receiver || !sms->receiver->lu_complete) {
+			     "Subscriber %s is not attached, skipping SMS %llu\n",
+			     vlr_subscr_msisdn_or_name(sms->receiver), sms->id);
+			talloc_free(sms);
+		}
 		return sms;

To view, visit
To unsubscribe, or for help writing mail filters, visit

Gerrit-Project: osmo-msc
Gerrit-Branch: master
Gerrit-MessageType: newchange
Gerrit-Change-Id: Iad5e4d84d8d410ea43d5907e9ddf6e5fdb55bc7a
Gerrit-Change-Number: 13450
Gerrit-PatchSet: 1
Gerrit-Owner: Vadim Yanitskiy <axilirator at>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <>

More information about the gerrit-log mailing list