Changeset 5762 for pjproject/trunk/pjsip/src/pjsua-lib/pjsua_core.c

Timestamp:

Apr 2, 2018 2:53:48 AM (7 years ago)

Author:

riza

Message:

Fixed #2041: Prevent double free on Failed STUN resolution.

File:

• pjproject/trunk/pjsip/src/pjsua-lib/pjsua_core.c (modified) (8 diffs)

pjproject/trunk/pjsip/src/pjsua-lib/pjsua_core.c

@@ -1252 +1252 @@
     pj_time_val timeout = {0, 0};
 
+    if (sess->destroy_flag)
+        return;
+
     sess->destroy_flag = PJ_TRUE;
-
-    /* If the STUN resolution session is blocking, only the waiting thread
-     * is allowed to destroy the session, otherwise it may cause deadlock.
-     */
-    if (sess->blocking) {
-        if (sess->waiter != pj_thread_this())
-            return;
-
-        /* Before destroying, make sure ref count is zero. */
-        while (sess->ref_cnt > 0)
-            pj_thread_sleep(10);
-
-    } else if (sess->ref_cnt > 0)
-        return;
-
     if (sess->stun_sock) {
         pj_stun_sock_destroy(sess->stun_sock);
@@ -1291 +1279 @@
 static void stun_resolve_dec_ref(pjsua_stun_resolve *sess)
 {
-    --sess->ref_cnt;
-    if (sess->ref_cnt <= 0 && sess->destroy_flag)
-        destroy_stun_resolve(sess);
+    int ref_cnt = --sess->ref_cnt;
+    /* If the STUN resolution session is blocking, only the waiting thread
+     * is allowed to destroy the session, otherwise it may cause deadlock.
+     */
+    if ((ref_cnt > 0) ||
+        (sess->blocking && (sess->waiter != pj_thread_this()))) 
+    {
+        return;
+    }
+
+    destroy_stun_resolve(sess);
 }
 
@@ -1333 +1329 @@
 on_return:
     if (!sess->blocking) {
-        destroy_stun_resolve(sess);
+        stun_resolve_dec_ref(sess);
     }
 }
@@ -1564 +1560 @@
     sess->status = PJ_EPENDING;
     sess->af = pj_AF_INET();
+    stun_resolve_add_ref(sess);
     sess->srv = (pj_str_t*) pj_pool_calloc(pool, count, sizeof(pj_str_t));
     for (i=0; i<count; ++i) {
@@ -1584 +1581 @@
     max_wait_ms = count * pjsua_var.stun_cfg.rto_msec * (1 << 7);
     pj_get_timestamp(&start);
-
-    while (sess->status == PJ_EPENDING) {
+    
+    while ((sess->status == PJ_EPENDING) && (!sess->destroy_flag)) {
         /* If there is no worker thread or
          * the function is called from the only worker thread,
@@ -1605 +1602 @@
 
     status = sess->status;
-    destroy_stun_resolve(sess);
+    stun_resolve_dec_ref(sess);
 
     return status;
@@ -1625 +1622 @@
 
         if (sess->token == token) {
+            sess->has_result = PJ_TRUE;
+            sess->status = PJ_ECANCELLED;
             if (notify_cb) {
                 pj_stun_resolve_result result;
@@ -1633 +1632 @@
 
                 sess->cb(&result);
-            }
-
-            destroy_stun_resolve(sess);
+            }       
             ++cancelled_count;
         }