Changeset 2811 for pjproject

Timestamp:

Jun 25, 2009 1:01:06 PM (15 years ago)

Author:

bennylp

Message:

Ticket #787: Crash when UAC invite or subscribe session initialization fails (thanks Rostislav Molodyko for the report)

• backported changes from #786

Location:

pjproject/branches/1.0/pjsip/src

Files:

• pjsip-ua/sip_inv.c (modified) (1 diff)
• pjsua-lib/pjsua_call.c (modified) (4 diffs)
• pjsua-lib/pjsua_pres.c (modified) (5 diffs)

pjproject/branches/1.0/pjsip/src/pjsip-ua/sip_inv.c

@@ -1368 +1368 @@
 
         status = pjmedia_sdp_neg_get_neg_local(inv->neg, &offer);
-        if (status != PJ_SUCCESS)
+        if (status != PJ_SUCCESS) {
+            pjsip_tx_data_dec_ref(tdata);
             goto on_return;
+        }
 
         tdata->msg->body = create_sdp_body(tdata->pool, offer);

pjproject/branches/1.0/pjsip/src/pjsua-lib/pjsua_call.c

@@ -449 +449 @@
     }
 
+    /* Increment the dialog's lock otherwise when invite session creation
+     * fails the dialog will be destroyed prematurely.
+     */
+    pjsip_dlg_inc_lock(dlg);
+
     /* Calculate call's secure level */
     call->secure_level = get_secure_level(acc_id, dest_uri);
@@ -539 +544 @@
                      status);
 
-        /* Upon failure to send first request, both dialog and invite 
+        /* Upon failure to send first request, the invite 
          * session would have been cleared.
          */
         inv = NULL;
-        dlg = NULL;
         goto on_error;
     }
@@ -552 +556 @@
         *p_call_id = call_id;
 
+    pjsip_dlg_dec_lock(dlg);
     pj_pool_release(tmp_pool);
     PJSUA_UNLOCK();
@@ -559 +564 @@
 
 on_error:
+    if (dlg) {
+        /* This may destroy the dialog */
+        pjsip_dlg_dec_lock(dlg);
+    }
+
     if (inv != NULL) {
         pjsip_inv_terminate(inv, PJSIP_SC_OK, PJ_FALSE);
-    } else if (dlg) {
-        pjsip_dlg_terminate(dlg);
     }
 

pjproject/branches/1.0/pjsip/src/pjsua-lib/pjsua_pres.c

@@ -1443 +1443 @@
     }
 
+    /* Increment the dialog's lock otherwise when presence session creation
+     * fails the dialog will be destroyed prematurely.
+     */
+    pjsip_dlg_inc_lock(buddy->dlg);
+
     status = pjsip_pres_create_uac( buddy->dlg, &pres_callback, 
                                     PJSIP_EVSUB_NO_EVENT_ID, &buddy->sub);
@@ -1449 +1454 @@
         pjsua_perror(THIS_FILE, "Unable to create presence client", 
                      status);
-        pjsip_dlg_terminate(buddy->dlg);
+        /* This should destroy the dialog since there's no session
+         * referencing it
+         */
+        pjsip_dlg_dec_lock(buddy->dlg);
         if (tmp_pool) pj_pool_release(tmp_pool);
         return;
@@ -1482 +1490 @@
     status = pjsip_pres_initiate(buddy->sub, -1, &tdata);
     if (status != PJ_SUCCESS) {
+        pjsip_dlg_dec_lock(buddy->dlg);
         if (buddy->sub) {
             pjsip_pres_terminate(buddy->sub, PJ_FALSE);
@@ -1496 +1505 @@
     status = pjsip_pres_send_request(buddy->sub, tdata);
     if (status != PJ_SUCCESS) {
+        pjsip_dlg_dec_lock(buddy->dlg);
         if (buddy->sub) {
             pjsip_pres_terminate(buddy->sub, PJ_FALSE);
@@ -1506 +1516 @@
     }
 
+    pjsip_dlg_dec_lock(buddy->dlg);
     if (tmp_pool) pj_pool_release(tmp_pool);
 }