Changeset 3031 for pjproject

Timestamp:

Dec 10, 2009 5:16:23 AM (15 years ago)

Author:

bennylp

Message:

Ticket #1002: Crash when adding/removing buddies (thanks Nikolay Popok and Robert Cichielo for the reports)

• the timer associated with a buddy is not removed when buddy is deleted, causing crash later on in timer heap. Fixed.
• when fails to send the initial SUBSCRIBE request, the dialog associated with buddy subscription will have been destroyed in the callback, causing any subsequent "pjsip_dlg_dec_lock(buddy->dlg)" call to crash. Fixed by protecting the call with "if (buddy->dlg)".

Location:

pjproject/trunk/pjsip/src

Files:

• pjsip/sip_dialog.c (modified) (1 diff)
• pjsua-lib/pjsua_pres.c (modified) (7 diffs)

pjproject/trunk/pjsip/src/pjsip/sip_dialog.c

@@ -855 +855 @@
 PJ_DEF(void) pjsip_dlg_dec_lock(pjsip_dialog *dlg)
 {
+    PJ_ASSERT_ON_FAIL(dlg!=NULL, return);
+
     PJ_LOG(6,(dlg->obj_name, "Entering pjsip_dlg_dec_lock(), sess_count=%d", 
               dlg->sess_count));

pjproject/trunk/pjsip/src/pjsua-lib/pjsua_pres.c

@@ -508 +508 @@
     pjsua_var.buddy[buddy_id].uri.slen = 0;
     pjsua_var.buddy_cnt--;
+
+    /* Clear timer */
+    if (pjsua_var.buddy[buddy_id].timer.id) {
+        pjsua_cancel_timer(&pjsua_var.buddy[buddy_id].timer);
+        pjsua_var.buddy[buddy_id].timer.id = PJ_FALSE;
+    }
 
     /* Reset buddy struct */
@@ -1729 +1735 @@
          * referencing it
          */
-        pjsip_dlg_dec_lock(buddy->dlg);
+        if (buddy->dlg) pjsip_dlg_dec_lock(buddy->dlg);
         if (tmp_pool) pj_pool_release(tmp_pool);
         return;
@@ -1762 +1768 @@
     status = pjsip_pres_initiate(buddy->sub, -1, &tdata);
     if (status != PJ_SUCCESS) {
-        pjsip_dlg_dec_lock(buddy->dlg);
+        if (buddy->dlg) pjsip_dlg_dec_lock(buddy->dlg);
         if (buddy->sub) {
             pjsip_pres_terminate(buddy->sub, PJ_FALSE);
@@ -1777 +1783 @@
     status = pjsip_pres_send_request(buddy->sub, tdata);
     if (status != PJ_SUCCESS) {
-        pjsip_dlg_dec_lock(buddy->dlg);
+        if (buddy->dlg) pjsip_dlg_dec_lock(buddy->dlg);
         if (buddy->sub) {
             pjsip_pres_terminate(buddy->sub, PJ_FALSE);
@@ -2010 +2016 @@
         pjsua_perror(THIS_FILE, "Error creating MWI subscription", status);
         if (tmp_pool) pj_pool_release(tmp_pool);
-        pjsip_dlg_dec_lock(acc->mwi_dlg);
+        if (acc->mwi_dlg) pjsip_dlg_dec_lock(acc->mwi_dlg);
         return;
     }
@@ -2042 +2048 @@
     status = pjsip_mwi_initiate(acc->mwi_sub, -1, &tdata);
     if (status != PJ_SUCCESS) {
-        pjsip_dlg_dec_lock(acc->mwi_dlg);
+        if (acc->mwi_dlg) pjsip_dlg_dec_lock(acc->mwi_dlg);
         if (acc->mwi_sub) {
             pjsip_pres_terminate(acc->mwi_sub, PJ_FALSE);
@@ -2058 +2064 @@
     status = pjsip_pres_send_request(acc->mwi_sub, tdata);
     if (status != PJ_SUCCESS) {
-        pjsip_dlg_dec_lock(acc->mwi_dlg);
+        if (acc->mwi_dlg) pjsip_dlg_dec_lock(acc->mwi_dlg);
         if (acc->mwi_sub) {
             pjsip_pres_terminate(acc->mwi_sub, PJ_FALSE);