pespin submitted this change.
iuup: Validate msgb input length in rx Initialization path
Input length validation of msgb was left as a TODO in
iuup_rx_initialization(), which could end up in OOB reads.
Related: OS#7063
Reported-By: Adam Bedard <adam.bedard@gmail.com>
Change-Id: Id0f7b0f63efc37376024359a3bf7fabbc40bc387
---
M src/gsm/iuup.c
M tests/iuup/iuup_test.c
M tests/iuup/iuup_test.err
M tests/iuup/iuup_test.ok
4 files changed, 327 insertions(+), 59 deletions(-)
diff --git a/src/gsm/iuup.c b/src/gsm/iuup.c
index b7aa5f9..a233fb9 100644
--- a/src/gsm/iuup.c
+++ b/src/gsm/iuup.c
@@ -539,7 +539,8 @@
/* return: whether the last Init was Acked correctly and hence can transition to next state */
static bool iuup_rx_initialization(struct osmo_iuup_instance *iui, struct osmo_iuup_tnl_prim *itp)
{
- struct iuup_pdutype14_hdr *hdr;
+ struct msgb *msg = itp->oph.msg;
+ struct iuup_pdutype14_hdr *hdr = (struct iuup_pdutype14_hdr *)msgb_l2(msg);
struct iuup_ctrl_init_hdr *ihdr;
struct iuup_ctrl_init_rfci_hdr *ihdr_rfci;
struct iuup_ctrl_init_tail *itail;
@@ -551,9 +552,16 @@
struct osmo_iuup_rnl_prim *irp;
struct osmo_iuup_tnl_prim *resp;
- /* TODO: whenever we check message boundaries, length, etc. and we fail, send NACK */
+ /* We expect at least the INIT header with at least 1 RFCI header: */
+ if (msgb_l2len(msg) < sizeof(struct iuup_pdutype14_hdr) +
+ sizeof(struct iuup_ctrl_init_hdr) +
+ sizeof(struct iuup_ctrl_init_rfci_hdr)) {
+ LOGPFSML(iui->fi, LOGL_NOTICE,
+ "Initialization: Malformed packet, length %u too short\n", msgb_l2len(msg));
+ err_cause = IUUP_ERR_CAUSE_FRAME_TOO_SHORT;
+ goto send_nack;
+ }
- hdr = (struct iuup_pdutype14_hdr *)msgb_l2(itp->oph.msg);
ihdr = (struct iuup_ctrl_init_hdr *)hdr->payload;
if (ihdr->num_subflows_per_rfci == 0) {
LOGPFSML(iui->fi, LOGL_NOTICE, "Initialization: Unexpected num_subflows=0 received\n");
@@ -562,16 +570,33 @@
}
ihdr_rfci = (struct iuup_ctrl_init_rfci_hdr *)ihdr->rfci_data;
+ /* Iterate over RFCIs and parse and store its subflow lengths: */
do {
struct osmo_iuup_rfci *rfci = &iui->config.rfci[num_rfci];
uint8_t l_size_bytes = ihdr_rfci->li + 1;
+ struct iuup_ctrl_init_rfci_hdr *next_ihdr_rfci =
+ (struct iuup_ctrl_init_rfci_hdr *)(&ihdr_rfci->subflow_length[0] +
+ (ihdr->num_subflows_per_rfci * l_size_bytes));
is_last = ihdr_rfci->lri;
+
if (num_rfci >= IUUP_MAX_RFCIS) {
LOGPFSML(iui->fi, LOGL_NOTICE, "Initialization: Too many RFCIs received (%u)\n",
- num_rfci);
+ num_rfci);
err_cause = IUUP_ERR_CAUSE_UNEXPECTED_RFCI;
goto send_nack;
}
+
+ /* Check contents of current RFCI are available in msgb, and if not last RFCI,
+ * also check for availability of next ihdr_rfci, all in one go: */
+ if ((((uint8_t *)next_ihdr_rfci) + (is_last ? 0 : sizeof(struct iuup_ctrl_init_rfci_hdr))) >
+ msg->tail) {
+ LOGPFSML(iui->fi, LOGL_NOTICE,
+ "Initialization: Malformed packet, length %u too short\n",
+ msgb_l2len(msg));
+ err_cause = IUUP_ERR_CAUSE_FRAME_TOO_SHORT;
+ goto send_nack;
+ }
+
rfci->used = 1;
rfci->id = ihdr_rfci->rfci;
if (l_size_bytes == 2) {
@@ -588,13 +613,21 @@
}
}
num_rfci++;
- ihdr_rfci++;
- ihdr_rfci = (struct iuup_ctrl_init_rfci_hdr *)(((uint8_t *)ihdr_rfci) + ihdr->num_subflows_per_rfci * l_size_bytes);
+ ihdr_rfci = next_ihdr_rfci;
} while (!is_last);
if (ihdr->ti) { /* Timing information present */
uint8_t *buf = (uint8_t *)ihdr_rfci;
uint8_t num_bytes = (num_rfci + 1) / 2;
+
+ if (buf + num_bytes > msg->tail) {
+ LOGPFSML(iui->fi, LOGL_NOTICE,
+ "Initialization: Malformed packet, length %u too short\n",
+ msgb_l2len(msg));
+ err_cause = IUUP_ERR_CAUSE_FRAME_TOO_SHORT;
+ goto send_nack;
+ }
+
iui->config.IPTIs_present = true;
for (i = 0; i < num_bytes - 1; i++) {
iui->config.rfci[i*2].IPTI = *buf >> 4;
@@ -610,6 +643,15 @@
iui->config.IPTIs_present = false;
itail = (struct iuup_ctrl_init_tail *)ihdr_rfci;
}
+
+ if (((uint8_t *)itail) + sizeof(*itail) > msg->tail) {
+ LOGPFSML(iui->fi, LOGL_NOTICE,
+ "Initialization: Malformed packet, length %u too short\n",
+ msgb_l2len(msg));
+ err_cause = IUUP_ERR_CAUSE_FRAME_TOO_SHORT;
+ goto send_nack;
+ }
+
if (itail->data_pdu_type > 1) {
LOGPFSML(iui->fi, LOGL_NOTICE, "Initialization: Unexpected Data PDU Type %u received\n", itail->data_pdu_type);
err_cause = IUUP_ERR_CAUSE_UNEXPECTED_VALUE;
@@ -643,9 +685,10 @@
resp = itp_ctrl_ack_alloc(iui, IUUP_PROC_INIT, hdr->frame_nr);
iui->transport_prim_cb(&resp->oph, iui->transport_prim_priv);
return ihdr->chain_ind == 0;
+
send_nack:
LOGPFSML(iui->fi, LOGL_NOTICE, "Tx Initialization NACK cause=%u orig_message=%s\n",
- err_cause, osmo_hexdump((const unsigned char *) msgb_l2(itp->oph.msg), msgb_l2len(itp->oph.msg)));
+ err_cause, osmo_hexdump((const unsigned char *) msgb_l2(msg), msgb_l2len(msg)));
resp = tnp_ctrl_nack_alloc(iui, IUUP_PROC_INIT, err_cause, hdr->frame_nr);
iui->transport_prim_cb(&resp->oph, iui->transport_prim_priv);
return false;
diff --git a/tests/iuup/iuup_test.c b/tests/iuup/iuup_test.c
index 725a7d9..353c76a 100644
--- a/tests/iuup/iuup_test.c
+++ b/tests/iuup/iuup_test.c
@@ -31,6 +31,56 @@
.t_rc = { .t_ms = IUUP_TIMER_RC_T_DEFAULT, .n_max = IUUP_TIMER_RC_N_DEFAULT },
};
+/* Frame 46, "Initialization", SYS#5969 call4_Iu_Iuh.pcap
+ 1110 .... = PDU Type: Control Procedure (14)
+ .... 00.. = Ack/Nack: Procedure (0)
+ .... ..00 = Frame Number: 0
+ 0000 .... = Mode Version: 0x0
+ .... 0000 = Procedure: Initialization (0)
+ 1101 11.. = Header CRC: 0x37 [correct]
+ .... ..01 1011 0100 = Payload CRC: 0x1b4
+ 000. .... = Spare: 0x0
+ ...0 .... = TI: IPTIs not present (0)
+ .... 011. = Subflows: 3
+ .... ...0 = Chain Indicator: this frame is the last frame for the procedure (0)
+ RFCI 1 Initialization
+ 0... .... = RFCI 0 LRI: Not last RFCI (0x0)
+ .0.. .... = RFCI 0 LI: one octet used (0x0)
+ ..00 0001 = RFCI 0: 1
+ RFCI 0 Flow 0 Len: 81
+ RFCI 0 Flow 1 Len: 103
+ RFCI 0 Flow 2 Len: 60
+ RFCI 6 Initialization
+ 1... .... = RFCI 1 LRI: Last RFCI in current frame (0x1)
+ .0.. .... = RFCI 1 LI: one octet used (0x0)
+ ..00 0110 = RFCI 1: 6
+ RFCI 1 Flow 0 Len: 39
+ RFCI 1 Flow 1 Len: 0
+ RFCI 1 Flow 2 Len: 0
+ Iu UP Mode Versions Supported: 0x0001
+ 0... .... .... .... = Version 16: not supported (0x0)
+ .0.. .... .... .... = Version 15: not supported (0x0)
+ ..0. .... .... .... = Version 14: not supported (0x0)
+ ...0 .... .... .... = Version 13: not supported (0x0)
+ .... 0... .... .... = Version 12: not supported (0x0)
+ .... .0.. .... .... = Version 11: not supported (0x0)
+ .... ..0. .... .... = Version 10: not supported (0x0)
+ .... ...0 .... .... = Version 9: not supported (0x0)
+ .... .... 0... .... = Version 8: not supported (0x0)
+ .... .... .0.. .... = Version 7: not supported (0x0)
+ .... .... ..0. .... = Version 6: not supported (0x0)
+ .... .... ...0 .... = Version 5: not supported (0x0)
+ .... .... .... 0... = Version 4: not supported (0x0)
+ .... .... .... .0.. = Version 3: not supported (0x0)
+ .... .... .... ..0. = Version 2: not supported (0x0)
+ .... .... .... ...1 = Version 1: supported (0x1)
+ 0000 .... = RFCI Data Pdu Type: PDU type 0 (0x0)
+*/
+const uint8_t iuup_initialization_no_iptis[] = {
+ 0xe0, 0x00, 0xdd, 0xb4, 0x06, 0x01, 0x51, 0x67, 0x3c, 0x86, 0x27,
+ 0x00, 0x00, 0x00, 0x01, 0x00
+};
+
/* Frame 33, "Initialization", OS#4744 3g_call_23112021.pcapng
IuUP
1110 .... = PDU Type: Control Procedure (14)
@@ -665,56 +715,6 @@
struct iuup_pdutype14_hdr *hdr14;
int rc;
- /* Frame 46, "Initialization", SYS#5969 call4_Iu_Iuh.pcap
- 1110 .... = PDU Type: Control Procedure (14)
- .... 00.. = Ack/Nack: Procedure (0)
- .... ..00 = Frame Number: 0
- 0000 .... = Mode Version: 0x0
- .... 0000 = Procedure: Initialization (0)
- 1101 11.. = Header CRC: 0x37 [correct]
- .... ..01 1011 0100 = Payload CRC: 0x1b4
- 000. .... = Spare: 0x0
- ...0 .... = TI: IPTIs not present (0)
- .... 011. = Subflows: 3
- .... ...0 = Chain Indicator: this frame is the last frame for the procedure (0)
- RFCI 1 Initialization
- 0... .... = RFCI 0 LRI: Not last RFCI (0x0)
- .0.. .... = RFCI 0 LI: one octet used (0x0)
- ..00 0001 = RFCI 0: 1
- RFCI 0 Flow 0 Len: 81
- RFCI 0 Flow 1 Len: 103
- RFCI 0 Flow 2 Len: 60
- RFCI 6 Initialization
- 1... .... = RFCI 1 LRI: Last RFCI in current frame (0x1)
- .0.. .... = RFCI 1 LI: one octet used (0x0)
- ..00 0110 = RFCI 1: 6
- RFCI 1 Flow 0 Len: 39
- RFCI 1 Flow 1 Len: 0
- RFCI 1 Flow 2 Len: 0
- Iu UP Mode Versions Supported: 0x0001
- 0... .... .... .... = Version 16: not supported (0x0)
- .0.. .... .... .... = Version 15: not supported (0x0)
- ..0. .... .... .... = Version 14: not supported (0x0)
- ...0 .... .... .... = Version 13: not supported (0x0)
- .... 0... .... .... = Version 12: not supported (0x0)
- .... .0.. .... .... = Version 11: not supported (0x0)
- .... ..0. .... .... = Version 10: not supported (0x0)
- .... ...0 .... .... = Version 9: not supported (0x0)
- .... .... 0... .... = Version 8: not supported (0x0)
- .... .... .0.. .... = Version 7: not supported (0x0)
- .... .... ..0. .... = Version 6: not supported (0x0)
- .... .... ...0 .... = Version 5: not supported (0x0)
- .... .... .... 0... = Version 4: not supported (0x0)
- .... .... .... .0.. = Version 3: not supported (0x0)
- .... .... .... ..0. = Version 2: not supported (0x0)
- .... .... .... ...1 = Version 1: supported (0x1)
- 0000 .... = RFCI Data Pdu Type: PDU type 0 (0x0)
- */
- const uint8_t iuup_init[] = {
- 0xe0, 0x00, 0xdd, 0xb4, 0x06, 0x01, 0x51, 0x67, 0x3c, 0x86, 0x27,
- 0x00, 0x00, 0x00, 0x01, 0x00
- };
-
iui = osmo_iuup_instance_alloc(iuup_test_ctx, __func__);
OSMO_ASSERT(iui);
osmo_iuup_instance_set_user_prim_cb(iui, _decode_passive_init_2_rfci_no_iptis_user_prim_cb, NULL);
@@ -732,9 +732,9 @@
/* Send Init: */
tnp = osmo_iuup_tnl_prim_alloc(iuup_test_ctx, OSMO_IUUP_TNL_UNITDATA, PRIM_OP_INDICATION, IUUP_MSGB_SIZE);
- tnp->oph.msg->l2h = msgb_put(tnp->oph.msg, sizeof(iuup_init));
+ tnp->oph.msg->l2h = msgb_put(tnp->oph.msg, sizeof(iuup_initialization_no_iptis));
hdr14 = (struct iuup_pdutype14_hdr *)msgb_l2(tnp->oph.msg);
- memcpy(hdr14, iuup_init, sizeof(iuup_init));
+ memcpy(hdr14, iuup_initialization_no_iptis, sizeof(iuup_initialization_no_iptis));
rc = osmo_iuup_tnl_prim_up(iui, tnp);
OSMO_ASSERT(rc == 0);
@@ -742,6 +742,176 @@
osmo_iuup_instance_free(iui);
}
+static int _decode_passive_init_exp_nack_transport_prim_cb(struct osmo_prim_hdr *oph, void *ctx)
+{
+ struct osmo_iuup_tnl_prim *itp = (struct osmo_iuup_tnl_prim *)oph;
+ struct msgb *msg;
+ struct iuup_pdutype14_hdr *hdr;
+
+ printf("%s()\n", __func__);
+ msg = oph->msg;
+ OSMO_ASSERT(OSMO_PRIM_HDR(&itp->oph) == OSMO_PRIM(OSMO_IUUP_TNL_UNITDATA, PRIM_OP_REQUEST));
+ printf("Transport: DL len=%u: %s\n", msgb_l2len(msg),
+ osmo_hexdump((const unsigned char *) msgb_l2(msg), msgb_l2len(msg)));
+ hdr = msgb_l2(msg);
+ OSMO_ASSERT(hdr->pdu_type == IUUP_PDU_T_CONTROL);
+ OSMO_ASSERT(hdr->ack_nack == IUUP_AN_NACK);
+ msgb_free(msg);
+ return 0;
+}
+/* Send a malformed Initialization to UIT containing num_subflows_per_rfci = 0.
+ * It shall be rejected since num_subflows_per_rfci should be at least one accoridng to 3GPP TS 25.415 Figure 24 */
+void test_decode_passive_init_malformed_0subflows(void)
+{
+ /* Here we check the passive INIT code path, aka receiving INIT and returning INIT_ACK/NACK */
+ struct osmo_iuup_instance *iui;
+ struct osmo_iuup_rnl_prim *rnp;
+ struct osmo_iuup_tnl_prim *tnp;
+ struct iuup_pdutype14_hdr *hdr14;
+ struct iuup_ctrl_init_hdr *ihdr;
+ uint16_t payload_crc;
+ int rc;
+
+ iui = osmo_iuup_instance_alloc(iuup_test_ctx, __func__);
+ OSMO_ASSERT(iui);
+ osmo_iuup_instance_set_transport_prim_cb(iui, _decode_passive_init_exp_nack_transport_prim_cb, NULL);
+
+ clock_override_set(0, 0);
+
+ /* Tx CONFIG.req */
+ rnp = osmo_iuup_rnl_prim_alloc(iuup_test_ctx, OSMO_IUUP_RNL_CONFIG, PRIM_OP_REQUEST, IUUP_MSGB_SIZE);
+ rnp->u.config = def_configure_req;
+ rnp->u.config.active = false;
+
+ rc = osmo_iuup_rnl_prim_down(iui, rnp);
+ OSMO_ASSERT(rc == 0);
+
+ /* Prepare and send Init: copy iuup_initialization_no_iptis, modify setting TI=1 (becoming malformed) and dispatch it. */
+ tnp = osmo_iuup_tnl_prim_alloc(iuup_test_ctx, OSMO_IUUP_TNL_UNITDATA, PRIM_OP_INDICATION, IUUP_MSGB_SIZE);
+ tnp->oph.msg->l2h = msgb_put(tnp->oph.msg, sizeof(iuup_initialization_no_iptis));
+ hdr14 = (struct iuup_pdutype14_hdr *)msgb_l2(tnp->oph.msg);
+ memcpy(hdr14, iuup_initialization_no_iptis, sizeof(iuup_initialization_no_iptis));
+
+ ihdr = (struct iuup_ctrl_init_hdr *)hdr14->payload;
+ ihdr->num_subflows_per_rfci = 0;
+ payload_crc = osmo_iuup_compute_payload_crc(msgb_l2(tnp->oph.msg), msgb_l2len(tnp->oph.msg));
+ hdr14->payload_crc_hi = (payload_crc >> 8) & 0x03;
+ hdr14->payload_crc_lo = payload_crc & 0xff;
+
+ rc = osmo_iuup_tnl_prim_up(iui, tnp);
+ OSMO_ASSERT(rc == 0);
+
+ osmo_iuup_instance_free(iui);
+}
+
+/* Send a malformed Initialization to UIT containing TI=1 and no IPTIs encoded.
+ * As a result, the msgb content is too short and should be rejected. */
+void test_decode_passive_init_malformed_ti1_no_iptis(void)
+{
+ /* Here we check the passive INIT code path, aka receiving INIT and returning INIT_ACK/NACK */
+ struct osmo_iuup_instance *iui;
+ struct osmo_iuup_rnl_prim *rnp;
+ struct osmo_iuup_tnl_prim *tnp;
+ struct iuup_pdutype14_hdr *hdr14;
+ struct iuup_ctrl_init_hdr *ihdr;
+ uint16_t payload_crc;
+ int rc;
+
+ iui = osmo_iuup_instance_alloc(iuup_test_ctx, __func__);
+ OSMO_ASSERT(iui);
+ osmo_iuup_instance_set_transport_prim_cb(iui, _decode_passive_init_exp_nack_transport_prim_cb, NULL);
+
+ clock_override_set(0, 0);
+
+ /* Tx CONFIG.req */
+ rnp = osmo_iuup_rnl_prim_alloc(iuup_test_ctx, OSMO_IUUP_RNL_CONFIG, PRIM_OP_REQUEST, IUUP_MSGB_SIZE);
+ rnp->u.config = def_configure_req;
+ rnp->u.config.active = false;
+
+ rc = osmo_iuup_rnl_prim_down(iui, rnp);
+ OSMO_ASSERT(rc == 0);
+
+ /* Prepare and send Init: copy iuup_initialization_no_iptis, modify setting TI=1 (becoming malformed) and dispatch it. */
+ tnp = osmo_iuup_tnl_prim_alloc(iuup_test_ctx, OSMO_IUUP_TNL_UNITDATA, PRIM_OP_INDICATION, IUUP_MSGB_SIZE);
+ tnp->oph.msg->l2h = msgb_put(tnp->oph.msg, sizeof(iuup_initialization_no_iptis));
+ hdr14 = (struct iuup_pdutype14_hdr *)msgb_l2(tnp->oph.msg);
+ memcpy(hdr14, iuup_initialization_no_iptis, sizeof(iuup_initialization_no_iptis));
+
+ ihdr = (struct iuup_ctrl_init_hdr *)hdr14->payload;
+ ihdr->ti = 1;
+ payload_crc = osmo_iuup_compute_payload_crc(msgb_l2(tnp->oph.msg), msgb_l2len(tnp->oph.msg));
+ hdr14->payload_crc_hi = (payload_crc >> 8) & 0x03;
+ hdr14->payload_crc_lo = payload_crc & 0xff;
+
+ rc = osmo_iuup_tnl_prim_up(iui, tnp);
+ OSMO_ASSERT(rc == 0);
+
+ osmo_iuup_instance_free(iui);
+}
+
+/* Send a malformed Initialization to UIT containing no RFCIs.
+ * As a result, the msgb content is too short and should be rejected. */
+void _test_submit_iuup_initialization_trimmed(unsigned int pkt_len, const char *test_name)
+{
+ /* Here we check the passive INIT code path, aka receiving INIT and returning INIT_ACK/NACK */
+ struct osmo_iuup_instance *iui;
+ struct osmo_iuup_rnl_prim *rnp;
+ struct osmo_iuup_tnl_prim *tnp;
+ struct iuup_pdutype14_hdr *hdr14;
+ uint16_t payload_crc;
+ int rc;
+
+ OSMO_ASSERT(pkt_len <= sizeof(iuup_initialization_no_iptis));
+
+ iui = osmo_iuup_instance_alloc(iuup_test_ctx, test_name);
+ OSMO_ASSERT(iui);
+ osmo_iuup_instance_set_transport_prim_cb(iui, _decode_passive_init_exp_nack_transport_prim_cb, NULL);
+
+ /* Tx CONFIG.req */
+ rnp = osmo_iuup_rnl_prim_alloc(iuup_test_ctx, OSMO_IUUP_RNL_CONFIG, PRIM_OP_REQUEST, IUUP_MSGB_SIZE);
+ rnp->u.config = def_configure_req;
+ rnp->u.config.active = false;
+
+ rc = osmo_iuup_rnl_prim_down(iui, rnp);
+ OSMO_ASSERT(rc == 0);
+
+ /* Prepare and send Init: copy iuup_initialization_no_iptis, modify setting TI=1 (becoming malformed) and dispatch it. */
+ tnp = osmo_iuup_tnl_prim_alloc(iuup_test_ctx, OSMO_IUUP_TNL_UNITDATA, PRIM_OP_INDICATION, IUUP_MSGB_SIZE);
+ tnp->oph.msg->l2h = msgb_put(tnp->oph.msg, pkt_len);
+ hdr14 = (struct iuup_pdutype14_hdr *)msgb_l2(tnp->oph.msg);
+ memcpy(hdr14, iuup_initialization_no_iptis, pkt_len);
+
+ payload_crc = osmo_iuup_compute_payload_crc(msgb_l2(tnp->oph.msg), msgb_l2len(tnp->oph.msg));
+ hdr14->payload_crc_hi = (payload_crc >> 8) & 0x03;
+ hdr14->payload_crc_lo = payload_crc & 0xff;
+
+ rc = osmo_iuup_tnl_prim_up(iui, tnp);
+ OSMO_ASSERT(rc == 0);
+
+ osmo_iuup_instance_free(iui);
+}
+void test_decode_passive_init_malformed_no_rfci(void)
+{
+ unsigned int pkt_len = sizeof(struct iuup_pdutype14_hdr) + sizeof(struct iuup_ctrl_init_hdr);
+ clock_override_set(0, 0);
+ _test_submit_iuup_initialization_trimmed(pkt_len, __func__);
+}
+
+/* Send a malformed Initialization to UIT containing malformed RFCIs.
+ * As a result, the msgb content is too short and should be rejected. */
+void test_decode_passive_init_malformed_rfci_too_short(void)
+{
+ unsigned int pkt_len = sizeof(struct iuup_pdutype14_hdr) + sizeof(struct iuup_ctrl_init_hdr) + 2;
+ clock_override_set(0, 0);
+ _test_submit_iuup_initialization_trimmed(pkt_len, __func__);
+}
+
+void test_decode_passive_init_malformed_missing_last_byte(void)
+{
+ clock_override_set(0, 0);
+ _test_submit_iuup_initialization_trimmed(sizeof(iuup_initialization_no_iptis) - 1, __func__);
+}
+
int main(int argc, char **argv)
{
iuup_test_ctx = talloc_named_const(NULL, 0, "iuup_test");
@@ -762,6 +932,11 @@
test_passive_init();
test_passive_init_retrans();
test_decode_passive_init_2_rfci_no_iptis();
+ test_decode_passive_init_malformed_0subflows();
+ test_decode_passive_init_malformed_ti1_no_iptis();
+ test_decode_passive_init_malformed_no_rfci();
+ test_decode_passive_init_malformed_rfci_too_short();
+ test_decode_passive_init_malformed_missing_last_byte();
printf("OK.\n");
}
diff --git a/tests/iuup/iuup_test.err b/tests/iuup/iuup_test.err
index fe1ed397..0298420 100644
--- a/tests/iuup/iuup_test.err
+++ b/tests/iuup/iuup_test.err
@@ -53,3 +53,38 @@
DLIUUP IuUP(test_decode_passive_init_2_rfci_no_iptis){Initialisation}: Tx Initialization ACK
DLIUUP IuUP(test_decode_passive_init_2_rfci_no_iptis){Initialisation}: state_chg to SMpSDU_Data_Transfer_Ready
DLIUUP IuUP(test_decode_passive_init_2_rfci_no_iptis){SMpSDU_Data_Transfer_Ready}: Deallocated
+DLIUUP IuUP(test_decode_passive_init_malformed_0subflows){NULL}: Allocated
+DLIUUP IuUP(test_decode_passive_init_malformed_0subflows){NULL}: Received Event IuUP-CONFIG-req
+DLIUUP IuUP(test_decode_passive_init_malformed_0subflows){NULL}: state_chg to Initialisation
+DLIUUP IuUP(test_decode_passive_init_malformed_0subflows){Initialisation}: Received Event INIT
+DLIUUP IuUP(test_decode_passive_init_malformed_0subflows){Initialisation}: Initialization: Unexpected num_subflows=0 received
+DLIUUP IuUP(test_decode_passive_init_malformed_0subflows){Initialisation}: Tx Initialization NACK cause=20 orig_message=e0 00 dc 62 00 01 51 67 3c 86 27 00 00 00 01 00
+DLIUUP IuUP(test_decode_passive_init_malformed_0subflows){Initialisation}: Deallocated
+DLIUUP IuUP(test_decode_passive_init_malformed_ti1_no_iptis){NULL}: Allocated
+DLIUUP IuUP(test_decode_passive_init_malformed_ti1_no_iptis){NULL}: Received Event IuUP-CONFIG-req
+DLIUUP IuUP(test_decode_passive_init_malformed_ti1_no_iptis){NULL}: state_chg to Initialisation
+DLIUUP IuUP(test_decode_passive_init_malformed_ti1_no_iptis){Initialisation}: Received Event INIT
+DLIUUP IuUP(test_decode_passive_init_malformed_ti1_no_iptis){Initialisation}: Initialization: Malformed packet, length 16 too short
+DLIUUP IuUP(test_decode_passive_init_malformed_ti1_no_iptis){Initialisation}: Tx Initialization NACK cause=8 orig_message=e0 00 dc 06 16 01 51 67 3c 86 27 00 00 00 01 00
+DLIUUP IuUP(test_decode_passive_init_malformed_ti1_no_iptis){Initialisation}: Deallocated
+DLIUUP IuUP(test_decode_passive_init_malformed_no_rfci){NULL}: Allocated
+DLIUUP IuUP(test_decode_passive_init_malformed_no_rfci){NULL}: Received Event IuUP-CONFIG-req
+DLIUUP IuUP(test_decode_passive_init_malformed_no_rfci){NULL}: state_chg to Initialisation
+DLIUUP IuUP(test_decode_passive_init_malformed_no_rfci){Initialisation}: Received Event INIT
+DLIUUP IuUP(test_decode_passive_init_malformed_no_rfci){Initialisation}: Initialization: Malformed packet, length 5 too short
+DLIUUP IuUP(test_decode_passive_init_malformed_no_rfci){Initialisation}: Tx Initialization NACK cause=8 orig_message=e0 00 dc cc 06
+DLIUUP IuUP(test_decode_passive_init_malformed_no_rfci){Initialisation}: Deallocated
+DLIUUP IuUP(test_decode_passive_init_malformed_rfci_too_short){NULL}: Allocated
+DLIUUP IuUP(test_decode_passive_init_malformed_rfci_too_short){NULL}: Received Event IuUP-CONFIG-req
+DLIUUP IuUP(test_decode_passive_init_malformed_rfci_too_short){NULL}: state_chg to Initialisation
+DLIUUP IuUP(test_decode_passive_init_malformed_rfci_too_short){Initialisation}: Received Event INIT
+DLIUUP IuUP(test_decode_passive_init_malformed_rfci_too_short){Initialisation}: Initialization: Malformed packet, length 7 too short
+DLIUUP IuUP(test_decode_passive_init_malformed_rfci_too_short){Initialisation}: Tx Initialization NACK cause=8 orig_message=e0 00 df 7d 06 01 51
+DLIUUP IuUP(test_decode_passive_init_malformed_rfci_too_short){Initialisation}: Deallocated
+DLIUUP IuUP(test_decode_passive_init_malformed_missing_last_byte){NULL}: Allocated
+DLIUUP IuUP(test_decode_passive_init_malformed_missing_last_byte){NULL}: Received Event IuUP-CONFIG-req
+DLIUUP IuUP(test_decode_passive_init_malformed_missing_last_byte){NULL}: state_chg to Initialisation
+DLIUUP IuUP(test_decode_passive_init_malformed_missing_last_byte){Initialisation}: Received Event INIT
+DLIUUP IuUP(test_decode_passive_init_malformed_missing_last_byte){Initialisation}: Initialization: Malformed packet, length 15 too short
+DLIUUP IuUP(test_decode_passive_init_malformed_missing_last_byte){Initialisation}: Tx Initialization NACK cause=8 orig_message=e0 00 df f7 06 01 51 67 3c 86 27 00 00 00 01
+DLIUUP IuUP(test_decode_passive_init_malformed_missing_last_byte){Initialisation}: Deallocated
diff --git a/tests/iuup/iuup_test.ok b/tests/iuup/iuup_test.ok
index 57baba9..204c290 100644
--- a/tests/iuup/iuup_test.ok
+++ b/tests/iuup/iuup_test.ok
@@ -58,4 +58,19 @@
_decode_passive_init_2_rfci_no_iptis_user_prim_cb(): Initialization decoded fine!
_decode_passive_init_2_rfci_no_iptis_transport_prim_cb()
Transport: DL len=4: e4 00 24 00
+sys={0.000000}, clock_override_set
+_decode_passive_init_exp_nack_transport_prim_cb()
+Transport: DL len=5: e8 00 90 00 50
+sys={0.000000}, clock_override_set
+_decode_passive_init_exp_nack_transport_prim_cb()
+Transport: DL len=5: e8 00 90 00 20
+sys={0.000000}, clock_override_set
+_decode_passive_init_exp_nack_transport_prim_cb()
+Transport: DL len=5: e8 00 90 00 20
+sys={0.000000}, clock_override_set
+_decode_passive_init_exp_nack_transport_prim_cb()
+Transport: DL len=5: e8 00 90 00 20
+sys={0.000000}, clock_override_set
+_decode_passive_init_exp_nack_transport_prim_cb()
+Transport: DL len=5: e8 00 90 00 20
OK.
To view, visit change 43247. To unsubscribe, or for help writing mail filters, visit settings.