Changeset 5720

Timestamp:

Jan 8, 2018 3:20:34 AM (7 years ago)

Author:

ming

Message:

Fixed #2079: Crash in pjsip due to race condition in account's keep alive timer

Location:

pjproject/trunk

Files:

• pjlib/src/pj/timer.c (modified) (2 diffs)
• pjsip/src/pjsua-lib/pjsua_acc.c (modified) (1 diff)

pjproject/trunk/pjlib/src/pj/timer.c

@@ -630 +630 @@
     {
         pj_timer_entry *node = remove_node(ht, 0);
+        /* Avoid re-use of this timer until the callback is done. */
+        pj_timer_id_t node_timer_id = pop_freelist(ht);
         pj_grp_lock_t *grp_lock;
 
@@ -648 +650 @@
 
         lock_timer_heap(ht);
+        /* Now, the timer is really free for re-use. */
+        push_freelist(ht, node_timer_id);
     }
     if (ht->cur_size && next_delay) {

pjproject/trunk/pjsip/src/pjsua-lib/pjsua_acc.c

@@ -2000 +2000 @@
 
     acc = (pjsua_acc*) te->user_data;
+
+    /* Check if the account is still active. It might have just been deleted
+     * while the keep-alive timer was about to be called (race condition).
+     */
+    if (acc->ka_transport == NULL)
+        goto on_return;
 
     /* Select the transport to send the packet */