--- /dev/null
+Bad messages:
+
+aar-bad.hex: comes from ../xml_examples/aar.xml
+ Consists in a deliberated bad length encoded on grouped Subscription-Id length field (not multiple of 4).
+
+aar2-bad.hex: comes from ../xml_examples/aar2.xml
+ Consists in a deliberated bad length encoded on enumerated Flow-Status avp 2-level nested inside Media-Component-Description:
+ -> Media-Component-Description (grouped)
+ -> Media-Sub-Component (grouped)
+ -> Flow-Status (enumerated)
--- /dev/null
+<message version="1" name="AA-Request" p-bit="yes" application-id="16777236" hop-by-hop-id="0" end-by-end-id="0">
+ <avp name="Session-Id" data="ocs3;1332774430;1;1332774430"/>
+ <avp name="Auth-Application-Id" data="16777236"/>
+ <avp name="Origin-Host" data="OCS3"/>
+ <avp name="Origin-Realm" data="OCS3"/>
+ <avp name="Destination-Realm" data="OCS3"/>
+ <avp name="Destination-Host" data="OCS3"/>
+ <avp name="AF-Application-Identifier" hex-data="313232"/>
+ <avp name="Media-Component-Description">
+ <avp name="Media-Component-Number" data="0"/>
+ <avp name="Media-Sub-Component">
+ <avp name="Flow-Number" data="55"/>
+ <avp name="Flow-Status" data="0" alias="ENABLED-UPLINK"/>
+ </avp>
+ <avp name="AF-Application-Identifier" hex-data="313232"/>
+ <avp name="Max-Requested-Bandwidth-UL" data="127"/>
+ <avp name="Max-Requested-Bandwidth-DL" data="133"/>
+ <avp name="Flow-Status" data="2" alias="ENABLED"/>
+ <avp name="Reservation-Priority" data="0" alias="DEFAULT"/>
+ </avp>
+ <avp name="Service-Info-Status" data="0" alias="FINAL_SERVICE_INFORMATION"/>
+ <avp name="Subscription-Id">
+ <avp name="Subscription-Id-Type" data="0" alias="END_USER_E164"/>
+ <avp name="Subscription-Id-Data" data="626037099"/>
+ </avp>
+ <avp name="Framed-IP-Address" hex-data="3139322e3136382e302e31"/>
+ <avp name="Called-Station-Id" data="WAP.MOVISTAR"/>
+</message>
--- /dev/null
+# Bad length encoded on enumerated Flow-Status avp 2-level nested (Media-Component-Description -> Media-Sub-Component -> Flow-Status)
+
+# Send malformed AAR to the server:
+SENDHEX2E aar2-bad.hex
+
+# Wait for message:
+WAIT4MESSAGE
+
+# Check Failed-AVP & Subscription-Id within:
+CHECKPATTERN <avp name="Result-Code" data="5014" alias="DIAMETER_INVALID_AVP_LENGTH"/>
+CHECKPATTERN <avp name="Failed-AVP">( *)<avp name="Media-Component-Description"
+
+# TODO: check that the complete hierarchy to Flow-Status (the real bad avp)