Changeset 5435 for pjproject/trunk/pjsip/src/pjsip-ua/sip_inv.c

Timestamp:

Aug 30, 2016 8:40:18 AM (8 years ago)

Author:

riza

Message:

Re #1959: Add reference counter to pjsip_inv_session to avoid race condition.

File:

• pjproject/trunk/pjsip/src/pjsip-ua/sip_inv.c (modified) (6 diffs)

pjproject/trunk/pjsip/src/pjsip-ua/sip_inv.c

@@ -196 +196 @@
 
 /*
+ * Add reference to INVITE session.
+ */
+PJ_DEF(pj_status_t) pjsip_inv_add_ref( pjsip_inv_session *inv )
+{
+    PJ_ASSERT_RETURN(inv && inv->ref_cnt, PJ_EINVAL);
+
+    pj_atomic_inc(inv->ref_cnt);
+
+    return PJ_SUCCESS;
+}
+
+static void inv_session_destroy(pjsip_inv_session *inv)
+{
+    if (inv->last_ack) {
+        pjsip_tx_data_dec_ref(inv->last_ack);
+        inv->last_ack = NULL;
+    }
+    if (inv->invite_req) {
+        pjsip_tx_data_dec_ref(inv->invite_req);
+        inv->invite_req = NULL;
+    }
+    if (inv->pending_bye) {
+        pjsip_tx_data_dec_ref(inv->pending_bye);
+        inv->pending_bye = NULL;
+    }
+    pjsip_100rel_end_session(inv);
+    pjsip_timer_end_session(inv);
+    pjsip_dlg_dec_session(inv->dlg, &mod_inv.mod);
+
+    /* Release the flip-flop pools */
+    pj_pool_release(inv->pool_prov);
+    inv->pool_prov = NULL;
+    pj_pool_release(inv->pool_active);
+    inv->pool_active = NULL;
+
+    pj_atomic_destroy(inv->ref_cnt);
+    inv->ref_cnt = NULL;
+}
+
+/*
+ * Decrease INVITE session reference, destroy it when the reference count
+ * reaches zero.
+ */
+PJ_DEF(pj_status_t) pjsip_inv_dec_ref( pjsip_inv_session *inv )
+{
+    pj_atomic_value_t ref_cnt;
+
+    PJ_ASSERT_RETURN(inv && inv->ref_cnt, PJ_EINVAL);
+
+    ref_cnt = pj_atomic_dec_and_get(inv->ref_cnt);
+    pj_assert( ref_cnt >= 0);
+    if (ref_cnt == 0) {
+        inv_session_destroy(inv);
+        return PJ_EGONE;
+    } 
+    return PJ_SUCCESS;    
+}
+
+/*
  * Set session state.
  */
@@ -262 +321 @@
         prev_state != PJSIP_INV_STATE_DISCONNECTED) 
     {
-        if (inv->last_ack) {
-            pjsip_tx_data_dec_ref(inv->last_ack);
-            inv->last_ack = NULL;
-        }
-        if (inv->invite_req) {
-            pjsip_tx_data_dec_ref(inv->invite_req);
-            inv->invite_req = NULL;
-        }
-        if (inv->pending_bye) {
-            pjsip_tx_data_dec_ref(inv->pending_bye);
-            inv->pending_bye = NULL;
-        }
-        pjsip_100rel_end_session(inv);
-        pjsip_timer_end_session(inv);
-        pjsip_dlg_dec_session(inv->dlg, &mod_inv.mod);
-
-        /* Release the flip-flop pools */
-        pj_pool_release(inv->pool_prov);
-        inv->pool_prov = NULL;
-        pj_pool_release(inv->pool_active);
-        inv->pool_active = NULL;
+        pjsip_inv_dec_ref(inv);
     }
 }
@@ -839 +878 @@
     pj_assert(inv != NULL);
 
+    status = pj_atomic_create(dlg->pool, 0, &inv->ref_cnt);
+    if (status != PJ_SUCCESS) {
+        pjsip_dlg_dec_lock(dlg);
+        return status;
+    }
+
     inv->pool = dlg->pool;
     inv->role = PJSIP_ROLE_UAC;
@@ -882 +927 @@
 
     /* Done */
+    pjsip_inv_add_ref(inv);
     *p_inv = inv;
 
@@ -1472 +1518 @@
     pj_assert(inv != NULL);
 
+    status = pj_atomic_create(dlg->pool, 0, &inv->ref_cnt);
+    if (status != PJ_SUCCESS) {
+        pjsip_dlg_dec_lock(dlg);
+        return status;
+    }
+
     inv->pool = dlg->pool;
     inv->role = PJSIP_ROLE_UAS;
@@ -1541 +1593 @@
 
     /* Done */
+    pjsip_inv_add_ref(inv);
     pjsip_dlg_dec_lock(dlg);
     *p_inv = inv;