Changeset 5927

Timestamp:

Jan 8, 2019 9:07:47 AM (6 years ago)

Author:

nanang

Message:

Fixed #2172: Avoid double reference counter decrements in timer in the scenario of race condition between pj_timer_heap_cancel() and pj_timer_heap_poll().

File:

• pjproject/trunk/pjlib/src/pj/timer.c (modified) (1 diff)

pjproject/trunk/pjlib/src/pj/timer.c

@@ -581 +581 @@
     lock_timer_heap(ht);
     count = cancel(ht, entry, flags | F_DONT_CALL);
-    if (flags & F_SET_ID) {
-        entry->id = id_val;
-    }
-    if (entry->_grp_lock) {
-        pj_grp_lock_t *grp_lock = entry->_grp_lock;
-        entry->_grp_lock = NULL;
-        pj_grp_lock_dec_ref(grp_lock);
+    if (count > 0) {
+        /* Timer entry found & cancelled */
+        if (flags & F_SET_ID) {
+            entry->id = id_val;
+        }
+        if (entry->_grp_lock) {
+            pj_grp_lock_t *grp_lock = entry->_grp_lock;
+            entry->_grp_lock = NULL;
+            pj_grp_lock_dec_ref(grp_lock);
+        }
     }
     unlock_timer_heap(ht);