Changeset 4926 for pjproject

Timestamp:

Sep 22, 2014 7:08:14 AM (10 years ago)

Author:

riza

Message:

Fixed #1791: Fixed possible crash when trying to cancel sdp negotiation upon receiving UPDATE response.

Location:

pjproject/trunk

Files:

• pjmedia/src/pjmedia/sdp_neg.c (modified) (1 diff)
• pjsip/src/pjsip-ua/sip_inv.c (modified) (7 diffs)

pjproject/trunk/pjmedia/src/pjmedia/sdp_neg.c

@@ -1401 +1401 @@
     neg->has_remote_answer = PJ_FALSE;
 
-    if (neg->state == PJMEDIA_SDP_NEG_STATE_LOCAL_OFFER) {
+    if (neg->state == PJMEDIA_SDP_NEG_STATE_LOCAL_OFFER &&
+        neg->active_local_sdp) 
+    {
         /* Increment next version number. This happens if for example
          * the reinvite offer is rejected by 488. If we don't increment

pjproject/trunk/pjsip/src/pjsip-ua/sip_inv.c

@@ -163 +163 @@
     pj_str_t             done_tag;  /* To tag in RX response with answer    */
     pj_bool_t            done_early;/* Negotiation was done for early med?  */
+    pj_bool_t            has_sdp;   /* Message with SDP?                    */
 };
 
@@ -712 +713 @@
         }
     }
+}
+
+/* 
+ * Check if tx_data has sdp. 
+ */
+static pj_bool_t tx_data_has_sdp(const pjsip_tx_data *tdata)
+{
+    pjsip_msg_body *body = tdata->msg->body;
+    pjsip_media_type app_sdp;
+
+    PJ_ASSERT_RETURN(tdata, PJ_FALSE);
+
+    pjsip_media_type_init2(&app_sdp, "application", "sdp");
+
+    if (body &&
+        pj_stricmp(&body->content_type.type, &app_sdp.type)==0 && 
+        pj_stricmp(&body->content_type.subtype, &app_sdp.subtype)==0) 
+    {
+        return PJ_TRUE;
+
+    } else if (body && 
+               pj_stricmp2(&body->content_type.type, "multipart") && 
+               (pj_stricmp2(&body->content_type.subtype, "mixed")==0 ||
+                pj_stricmp2(&body->content_type.subtype, "alternative")==0))    
+    {
+        pjsip_multipart_part *part;
+
+        part = pjsip_multipart_find_part(body, &app_sdp, NULL);
+        if (part) {
+            return PJ_TRUE;
+        }
+    }
+
+    return PJ_FALSE;
 }
 
@@ -1496 +1531 @@
     tsx_inv_data = PJ_POOL_ZALLOC_T(inv->invite_tsx->pool, struct tsx_inv_data);
     tsx_inv_data->inv = inv;
+    tsx_inv_data->has_sdp = (sdp_info->sdp!=NULL);
     inv->invite_tsx->mod_data[mod_inv.mod.id] = tsx_inv_data;
 
@@ -1852 +1888 @@
         tsx_inv_data = PJ_POOL_ZALLOC_T(tsx->pool, struct tsx_inv_data);
         tsx_inv_data->inv = inv;
+        tsx_inv_data->has_sdp = (sdp_info->sdp!=NULL);
         tsx->mod_data[mod_inv.mod.id] = tsx_inv_data;
     }
@@ -3059 +3096 @@
         tsx_inv_data = PJ_POOL_ZALLOC_T(inv->pool, struct tsx_inv_data);
         tsx_inv_data->inv = inv;
+        tsx_inv_data->has_sdp = tx_data_has_sdp(tdata);
 
         pjsip_dlg_dec_lock(inv->dlg);
@@ -3494 +3532 @@
                 PJMEDIA_SDP_NEG_STATE_LOCAL_OFFER &&
         tsx_inv_data && tsx_inv_data->sdp_done == PJ_FALSE &&
-        !tsx_inv_data->retrying)
+        !tsx_inv_data->retrying && tsx_inv_data->has_sdp)
     {
         pjmedia_sdp_neg_cancel_offer(inv->neg);
@@ -3570 +3608 @@
                                             struct tsx_inv_data);
             tsx_inv_data->inv = inv;
+            tsx_inv_data->has_sdp = PJ_TRUE;
             inv->invite_tsx->mod_data[mod_inv.mod.id] = tsx_inv_data;
         }