Currently the global current_test is not initialised, which leads to
memory access failures. In addition, the variable is signed but used
in comparisons with unsigned values.
This commit changes the type to size_t and initialises the variable
to 0.
Sponsored-by: On-Waves ehf
These fixes do not affect the semantics of the code. They either help
gcc by providing default values that won't be used ("may be
uninitialised"), remove unused variables, or change signed to
unsigned variables to avoid comparison warnings.
Addresses:
bts.cpp:494:32: warning: 'tbf' may be used uninitialized in this
function
emu/test_replay_gprs_attach.cpp:81:27: warning: comparison between
signed and unsigned integer expressions
emu/test_pdp_activation.cpp:95:23: warning: unused variable ‘budh’
emu/test_pdp_activation.cpp:97:6: warning: variable ‘rc’ set but
not used
emu/pcu_emu.cpp:109:26: warning: unused variable ‘bts’
alloc/AllocTest.cpp:74:27: warning: unused variable ‘tbf’
osmocom/core/utils.h:13:50: warning: comparison between signed and
unsigned integer expressions
types/TypesTest.cpp:319:7: warning: unused variable ‘count’
types/TypesTest.cpp:320:11: warning: unused variable ‘rbb’
alloc/AllocTest.cpp:74:27: warning: unused variable ‘tbf’
alloc/AllocTest.cpp:132:11: warning: unused variable ‘ts_no’
Coverity complains about this code as it doesn't know that the
OSMO_ASSERT is always on. But it is good practice to now have the
side-effect in here.
Fixes: Coverity CID 1080724
Compared to the previous code there will be a branch to get the
global pointer so the code will be slightly slower than the previous
version but it allows us to start creating objects but still use
the code from C. It is best approach I have found so far.
One downside of C++ is that by default talloc will not be used
(unless we override the new operator to use talloc. Right now
we need to memset the C data structure by hand. The benefit of
enforcing a better structure should is more important though.
Introduce the concept of tests that will be ran one after the other.
This new test will send static message that will lead to the opening
of a PDP context. At this point one should use ping with a large
packet size and suspend/stop the emulator. Once the NS connection is
considered dead the SGSN will crash with a double free.
Reproduce:
0.) Add IMSI 901700000003094 to the ACL
1.) Stop/Suspend the emulation process so the NS Alive times out
2.) Use ping IP -s 2048
This will create a double free...
#4 0xb7bb2646 in talloc_abort_double_free () at talloc.c:175
#5 0xb7bbd41a in talloc_chunk_from_ptr (ptr=0x8091208) at talloc.c:190
#6 _talloc_free (ptr=0x8091208) at talloc.c:517
#7 talloc_free (ptr=ptr@entry=0x8091208) at talloc.c:990
#8 0xb7bb319b in msgb_free (m=m@entry=0x8091208) at msgb.c:72
#9 0x0804db54 in sndcp_send_ud_frag (fs=0xbfffcc6c) at gprs_sndcp.c:423
#10 sndcp_unitdata_req (msg=msg@entry=0x808eed8, lle=0x808fbc8, nsapi=5 '\005',
mmcontext=mmcontext@entry=0x80903e8) at gprs_sndcp.c:471
This will send a static message. It will trigger the GMM code
on the SGSN and might ask us for the IMEI/IMSI or send us an
accept. As we are not replying at all the SGSN needs to send new
requests and we can observe if the sequence number is increasing
like it should.
Max
Neels Hofmeyr