Changeset 2380

Timestamp:

Dec 17, 2008 2:28:18 PM (15 years ago)

Author:

bennylp

Message:

Ticket 684: protect the memory allocation for TX packet with try/catch, and fixed various transmit data buffer leaks when transmission fails immediately

Location:

pjproject/trunk

Files:

• pjsip-apps/src/pjsua/pjsua_app.c (modified) (1 diff)
• pjsip/src/pjsip-ua/sip_inv.c (modified) (1 diff)
• pjsip/src/pjsip/sip_dialog.c (modified) (3 diffs)
• pjsip/src/pjsip/sip_transport.c (modified) (1 diff)
• pjsip/src/pjsip/sip_util.c (modified) (1 diff)
• pjsip/src/pjsua-lib/pjsua_call.c (modified) (4 diffs)

pjproject/trunk/pjsip-apps/src/pjsua/pjsua_app.c

@@ -2188 +2188 @@
     ring_start(call_id);
 
+    if (current_call==PJSUA_INVALID_ID)
+        current_call = call_id;
+
     if (app_config.auto_answer > 0) {
         pjsua_call_answer(call_id, app_config.auto_answer, NULL, NULL);

pjproject/trunk/pjsip/src/pjsip-ua/sip_inv.c

@@ -2815 +2815 @@
                     inv_set_state(inv, PJSIP_INV_STATE_EARLY, e);
                 break;
+            case PJSIP_TSX_STATE_TERMINATED:
+                /* there is a failure in sending response. */
+                inv_set_cause(inv, tsx->status_code, &tsx->status_text);
+                inv_set_state(inv, PJSIP_INV_STATE_DISCONNECTED, e);
+                break;
             default:
                 inv_on_state_incoming(inv, e);

pjproject/trunk/pjsip/src/pjsip/sip_dialog.c

@@ -541 +541 @@
     if (tsx) {
         pjsip_tsx_terminate(tsx, 500);
+        pj_assert(dlg->tsx_count>0);
         --dlg->tsx_count;
     }
@@ -1412 +1413 @@
     /* Ask transaction to send the response */
     status = pjsip_tsx_send_msg(tsx, tdata);
+
+    /* This function must decrement transmit data request counter 
+     * regardless of the operation status. The transaction only
+     * decrements the counter if the operation is successful.
+     */
+    if (status != PJ_SUCCESS) {
+        pjsip_tx_data_dec_ref(tdata);
+    }
 
     pjsip_dlg_dec_lock(dlg);
@@ -1899 +1908 @@
 
 
-    if (tsx->state == PJSIP_TSX_STATE_TERMINATED) {
+    /* It is possible that the transaction is terminated and this function
+     * is called while we're calling on_tsx_state(). So only decrement
+     * the tsx_count if we're still attached to the transaction.
+     */
+    if (tsx->state == PJSIP_TSX_STATE_TERMINATED &&
+        tsx->mod_data[dlg->ua->id] == dlg) 
+    {
+        pj_assert(dlg->tsx_count>0);
         --dlg->tsx_count;
         tsx->mod_data[dlg->ua->id] = NULL;

pjproject/trunk/pjsip/src/pjsip/sip_transport.c

@@ -569 +569 @@
     /* Allocate buffer if necessary. */
     if (tdata->buf.start == NULL) {
-        tdata->buf.start = (char*) 
-                           pj_pool_alloc( tdata->pool, PJSIP_MAX_PKT_LEN);
+        PJ_USE_EXCEPTION;
+
+        PJ_TRY {
+            tdata->buf.start = (char*) 
+                               pj_pool_alloc(tdata->pool, PJSIP_MAX_PKT_LEN);
+        }
+        PJ_CATCH_ANY {
+            return PJ_ENOMEM;
+        }
+        PJ_END
+
         tdata->buf.cur = tdata->buf.start;
         tdata->buf.end = tdata->buf.start + PJSIP_MAX_PKT_LEN;

pjproject/trunk/pjsip/src/pjsip/sip_util.c

@@ -1674 +1674 @@
     /* Send! */
     status = pjsip_endpt_send_response( endpt, &res_addr, tdata, NULL, NULL );
-
-    return status;
+    if (status != PJ_SUCCESS) {
+        pjsip_tx_data_dec_ref(tdata);
+        return status;
+    }
+
+    return PJ_SUCCESS;
 }
 

pjproject/trunk/pjsip/src/pjsua-lib/pjsua_call.c

@@ -910 +910 @@
     }
 
-    /* Create and attach pjsua_var data to the dialog: */
-    call->inv = inv;
-
-    dlg->mod_data[pjsua_var.mod.id] = call;
-    inv->mod_data[pjsua_var.mod.id] = call;
-
     /* If account is locked to specific transport, then lock dialog
      * to this transport too.
@@ -926 +920 @@
     }
 
-    /* Must answer with some response to initial INVITE.
+    /* Must answer with some response to initial INVITE. We'll do this before
+     * attaching the call to the invite session/dialog, so that the application
+     * will not get notification about this event (on another scenario, it is
+     * also possible that inv_send_msg() fails and causes the invite session to
+     * be disconnected. If we have the call attached at this time, this will
+     * cause the disconnection callback to be called before on_incoming_call()
+     * callback is called, which is not right).
      */
     status = pjsip_inv_initial_answer(inv, rdata, 
@@ -944 +944 @@
         if (status != PJ_SUCCESS) {
             pjsua_perror(THIS_FILE, "Unable to send 100 response", status);
-        }
-    }
+            PJSUA_UNLOCK();
+            return PJ_TRUE;
+        }
+    }
+
+    /* Create and attach pjsua_var data to the dialog: */
+    call->inv = inv;
+
+    dlg->mod_data[pjsua_var.mod.id] = call;
+    inv->mod_data[pjsua_var.mod.id] = call;
 
     ++pjsua_var.call_cnt;
@@ -3726 +3734 @@
                                             pjsip_event *e)
 {
-    pjsua_call *call = (pjsua_call*) inv->dlg->mod_data[pjsua_var.mod.id];
+    pjsua_call *call;
 
     PJSUA_LOCK();
+
+    call = (pjsua_call*) inv->dlg->mod_data[pjsua_var.mod.id];
+
+    if (call == NULL) {
+        PJSUA_UNLOCK();
+        return;
+    }
 
     /* Notify application callback first */