Changeset 4196

Timestamp:

Jul 5, 2012 7:02:50 AM (12 years ago)

Author:

bennylp

Message:

Re #1548: Crash due to racing condition in timer when call is disconnected quickly (thanks Joshua Colp for the report!)

Location:

pjproject/trunk

Files:

• pjnath/include/pjnath/ice_session.h (modified) (1 diff)
• pjnath/src/pjnath/ice_session.c (modified) (2 diffs)
• pjsip/src/pjsua-lib/pjsua_media.c (modified) (1 diff)

pjproject/trunk/pjnath/include/pjnath/ice_session.h

@@ -620 +620 @@
     pj_bool_t            is_nominating;             /**< Nominating stage   */
     pj_bool_t            is_complete;               /**< Complete?          */
+    pj_bool_t            is_destroying;             /**< Destroy is called  */
     pj_status_t          ice_status;                /**< Error status.      */
     pj_timer_entry       timer;                     /**< ICE timer.         */

pjproject/trunk/pjnath/src/pjnath/ice_session.c

@@ -456 +456 @@
     }
 
+    ice->is_destroying = PJ_TRUE;
+
     /* Let other callbacks finish */
     if (ice->mutex) {
@@ -1841 +1843 @@
     clist = td->clist;
 
+    if (ice->is_destroying)
+        return PJ_SUCCESS;
+
     pj_mutex_lock(ice->mutex);
+
+    if (ice->is_destroying) {
+        pj_mutex_unlock(ice->mutex);
+        return PJ_SUCCESS;
+    }
 
     /* Set timer ID to FALSE first */

pjproject/trunk/pjsip/src/pjsua-lib/pjsua_media.c

@@ -518 +518 @@
     pjsua_call *call = NULL;
     pjsip_dialog *dlg = NULL;
+
+    if (call_med->call == NULL)
+        return;
 
     acquire_call("med_tp_timer_cb", call_med->call->index, &call, &dlg);