Changeset 2593

Timestamp:

Apr 14, 2009 11:10:31 AM (15 years ago)

Author:

bennylp

Message:

Ticket #786: Crash when UAC invite or subscribe session initialization fails (thanks Rostislav Molodyko for the report)

Location:

pjproject/trunk/pjsip/src/pjsua-lib

Files:

• pjsua_call.c (modified) (4 diffs)
• pjsua_pres.c (modified) (5 diffs)

pjproject/trunk/pjsip/src/pjsua-lib/pjsua_call.c

@@ -468 +468 @@
     }
 
+    /* Increment the dialog's lock otherwise when invite session creation
+     * fails the dialog will be destroyed prematurely.
+     */
+    pjsip_dlg_inc_lock(dlg);
+
     /* Calculate call's secure level */
     call->secure_level = get_secure_level(acc_id, dest_uri);
@@ -558 +563 @@
                      status);
 
-        /* Upon failure to send first request, both dialog and invite 
+        /* Upon failure to send first request, the invite 
          * session would have been cleared.
          */
         inv = NULL;
-        dlg = NULL;
         goto on_error;
     }
@@ -571 +575 @@
         *p_call_id = call_id;
 
+    pjsip_dlg_dec_lock(dlg);
     pj_pool_release(tmp_pool);
     PJSUA_UNLOCK();
@@ -578 +583 @@
 
 on_error:
+    if (dlg) {
+        /* This may destroy the dialog */
+        pjsip_dlg_dec_lock(dlg);
+    }
+
     if (inv != NULL) {
         pjsip_inv_terminate(inv, PJSIP_SC_OK, PJ_FALSE);
-    } else if (dlg) {
-        pjsip_dlg_terminate(dlg);
     }
 

pjproject/trunk/pjsip/src/pjsua-lib/pjsua_pres.c

@@ -1443 +1443 @@
     }
 
+    /* Increment the dialog's lock otherwise when presence session creation
+     * fails the dialog will be destroyed prematurely.
+     */
+    pjsip_dlg_inc_lock(buddy->dlg);
+
     status = pjsip_pres_create_uac( buddy->dlg, &pres_callback, 
                                     PJSIP_EVSUB_NO_EVENT_ID, &buddy->sub);
@@ -1449 +1454 @@
         pjsua_perror(THIS_FILE, "Unable to create presence client", 
                      status);
-        pjsip_dlg_terminate(buddy->dlg);
+        /* This should destroy the dialog since there's no session
+         * referencing it
+         */
+        pjsip_dlg_dec_lock(buddy->dlg);
         if (tmp_pool) pj_pool_release(tmp_pool);
         return;
@@ -1482 +1490 @@
     status = pjsip_pres_initiate(buddy->sub, -1, &tdata);
     if (status != PJ_SUCCESS) {
+        pjsip_dlg_dec_lock(buddy->dlg);
         if (buddy->sub) {
             pjsip_pres_terminate(buddy->sub, PJ_FALSE);
@@ -1496 +1505 @@
     status = pjsip_pres_send_request(buddy->sub, tdata);
     if (status != PJ_SUCCESS) {
+        pjsip_dlg_dec_lock(buddy->dlg);
         if (buddy->sub) {
             pjsip_pres_terminate(buddy->sub, PJ_FALSE);
@@ -1506 +1516 @@
     }
 
+    pjsip_dlg_dec_lock(buddy->dlg);
     if (tmp_pool) pj_pool_release(tmp_pool);
 }