Changeset 1292

Timestamp:

May 23, 2007 2:12:35 PM (17 years ago)

Author:

bennylp

Message:

Fixed ticket #291: Free memory read in PUBLISH session

File:

• pjproject/trunk/pjsip/src/pjsip-simple/publishc.c (modified) (2 diffs)

pjproject/trunk/pjsip/src/pjsip-simple/publishc.c

@@ -545 +545 @@
         /* Call callback. */
         if (expiration == 0xFFFF) expiration = -1;
+
+        /* Temporarily increment pending_tsx to prevent callback from
+         * destroying pubc.
+         */
+        ++pubc->pending_tsx;
+
         call_callback(pubc, PJ_SUCCESS, tsx->status_code, 
                       (rdata ? &rdata->msg_info.msg->line.status.reason 
@@ -550 +556 @@
                       rdata, expiration);
 
+        --pubc->pending_tsx;
     }