Changeset 4630 for pjproject/trunk

Timestamp:

Oct 22, 2013 10:16:28 AM (11 years ago)

Author:

ming

Message:

Fixed #1706: Race condition in SIP transaction

File:

• pjproject/trunk/pjsip/src/pjsip/sip_transaction.c (modified) (4 diffs)

pjproject/trunk/pjsip/src/pjsip/sip_transaction.c

@@ -649 +649 @@
           pj_hash_get_lower( mod_tsx_layer.htable, key->ptr, 
                              (unsigned)key->slen, &hval );
+    
+    /* Prevent the transaction to get deleted before we have chance to lock it.
+     */
+    if (tsx && lock)
+        pj_grp_lock_add_ref(tsx->grp_lock);
+    
     pj_mutex_unlock(mod_tsx_layer.mutex);
 
@@ -655 +661 @@
                 hval, key->slen, key->ptr, tsx));
 
-    /* Race condition!
-     * Transaction may gets deleted before we have chance to lock it.
-     */
-    PJ_TODO(FIX_RACE_CONDITION_HERE);
+    /* Simulate race condition! */
     PJ_RACE_ME(5);
 
-    if (tsx && lock)
+    if (tsx && lock) {
         pj_grp_lock_acquire(tsx->grp_lock);
+        pj_grp_lock_dec_ref(tsx->grp_lock);
+    }
 
     return tsx;
@@ -799 +804 @@
     }
 
+    /* Prevent the transaction to get deleted before we have chance to lock it
+     * in pjsip_tsx_recv_msg().
+     */
+    pj_grp_lock_add_ref(tsx->grp_lock);
+    
     /* Unlock hash table. */
     pj_mutex_unlock( mod_tsx_layer.mutex );
 
-    /* Race condition!
-     * Transaction may gets deleted before we have chance to lock it
-     * in pjsip_tsx_recv_msg().
-     */
-    PJ_TODO(FIX_RACE_CONDITION_HERE);
+    /* Simulate race condition! */
     PJ_RACE_ME(5);
 
     /* Pass the message to the transaction. */
     pjsip_tsx_recv_msg(tsx, rdata );
+    
+    pj_grp_lock_dec_ref(tsx->grp_lock);
 
     return PJ_TRUE;
@@ -850 +858 @@
     }
 
+    /* Prevent the transaction to get deleted before we have chance to lock it
+     * in pjsip_tsx_recv_msg().
+     */
+    pj_grp_lock_add_ref(tsx->grp_lock);
+
     /* Unlock hash table. */
     pj_mutex_unlock( mod_tsx_layer.mutex );
 
-    /* Race condition!
-     * Transaction may gets deleted before we have chance to lock it
-     * in pjsip_tsx_recv_msg().
-     */
-    PJ_TODO(FIX_RACE_CONDITION_HERE);
+    /* Simulate race condition! */
     PJ_RACE_ME(5);
 
     /* Pass the message to the transaction. */
     pjsip_tsx_recv_msg(tsx, rdata );
+    
+    pj_grp_lock_dec_ref(tsx->grp_lock);
 
     return PJ_TRUE;