Changeset 5180

Timestamp:

Sep 17, 2015 6:11:01 AM (9 years ago)

Author:

ming

Message:

Fixed #1886: Ddestruction of locked mutex in SIP dialog

File:

• pjproject/trunk/pjsip/src/pjsip/sip_dialog.c (modified) (8 diffs)

pjproject/trunk/pjsip/src/pjsip/sip_dialog.c

@@ -109 +109 @@
 }
 
-static void destroy_dialog( pjsip_dialog *dlg )
+static void destroy_dialog( pjsip_dialog *dlg, pj_bool_t unlock_mutex )
 {
     if (dlg->mutex_) {
+        if (unlock_mutex) pj_mutex_unlock(dlg->mutex_);
         pj_mutex_destroy(dlg->mutex_);
         dlg->mutex_ = NULL;
@@ -303 +304 @@
 
 on_error:
-    destroy_dialog(dlg);
+    destroy_dialog(dlg, PJ_FALSE);
     return status;
 }
@@ -552 +553 @@
     }
 
-    destroy_dialog(dlg);
+    destroy_dialog(dlg, PJ_FALSE);
     return status;
 }
@@ -726 +727 @@
 
 on_error:
-    destroy_dialog(dlg);
+    destroy_dialog(dlg, PJ_FALSE);
     return status;
 }
@@ -734 +735 @@
  * Destroy dialog.
  */
-static pj_status_t unregister_and_destroy_dialog( pjsip_dialog *dlg )
+static pj_status_t unregister_and_destroy_dialog( pjsip_dialog *dlg,
+                                                  pj_bool_t unlock_mutex )
 {
     pj_status_t status;
@@ -758 +760 @@
 
     /* Destroy this dialog. */
-    destroy_dialog(dlg);
+    destroy_dialog(dlg, unlock_mutex);
 
     return PJ_SUCCESS;
@@ -775 +777 @@
     PJ_ASSERT_RETURN(dlg->tsx_count==0, PJ_EINVALIDOP);
 
-    return unregister_and_destroy_dialog(dlg);
+    return unregister_and_destroy_dialog(dlg, PJ_FALSE);
 }
 
@@ -894 +896 @@
         pj_mutex_unlock(dlg->mutex_);
         pj_mutex_lock(dlg->mutex_);
-        unregister_and_destroy_dialog(dlg);
+        /* We are holding the dialog mutex here, so before we destroy
+         * the dialog, make sure that we unlock it first to avoid
+         * undefined behaviour on some platforms. See ticket #1886.
+         */
+        unregister_and_destroy_dialog(dlg, PJ_TRUE);
     } else {
         pj_mutex_unlock(dlg->mutex_);