Changeset 2948 for pjproject/trunk

Timestamp:

Oct 15, 2009 4:46:39 AM (15 years ago)

Author:

bennylp

Message:

Fixed ticket #974: Crash if ICE session is destroyed by the application inside "on_ice_complete" with an PJ_ICE_STRANS_OP_NEGOTIATION op callback (thanks John Ridges for the report)

File:

• pjproject/trunk/pjnath/src/pjnath/ice_session.c (modified) (3 diffs)

pjproject/trunk/pjnath/src/pjnath/ice_session.c

@@ -1100 +1100 @@
     pj_ice_sess *ice = (pj_ice_sess*) te->user_data;
     enum timer_type type = (enum timer_type)te->id;
+    pj_bool_t has_mutex = PJ_TRUE;
 
     PJ_UNUSED_ARG(th);
@@ -1115 +1116 @@
         break;
     case TIMER_COMPLETION_CALLBACK:
-        /* Start keep-alive timer but don't send any packets yet.
-         * Need to do it here just in case app destroy the session
-         * in the callback.
-         */
-        if (ice->ice_status == PJ_SUCCESS)
-            ice_keep_alive(ice, PJ_FALSE);
-
-        /* Notify app about ICE completion*/
-        if (ice->cb.on_ice_complete)
-            (*ice->cb.on_ice_complete)(ice, ice->ice_status);
+        {
+            void (*on_ice_complete)(pj_ice_sess *ice, pj_status_t status);
+            pj_status_t ice_status;
+
+            /* Start keep-alive timer but don't send any packets yet.
+             * Need to do it here just in case app destroy the session
+             * in the callback.
+             */
+            if (ice->ice_status == PJ_SUCCESS)
+                ice_keep_alive(ice, PJ_FALSE);
+
+            /* Release mutex in case app destroy us in the callback */
+            ice_status = ice->ice_status;
+            on_ice_complete = ice->cb.on_ice_complete;
+            has_mutex = PJ_FALSE;
+            pj_mutex_unlock(ice->mutex);
+
+            /* Notify app about ICE completion*/
+            if (on_ice_complete)
+                (*on_ice_complete)(ice, ice_status);
+        }
         break;
     case TIMER_START_NOMINATED_CHECK:
@@ -1137 +1149 @@
     }
 
-    pj_mutex_unlock(ice->mutex);
+    if (has_mutex)
+        pj_mutex_unlock(ice->mutex);
 }