Changeset 5991 for pjproject/trunk/pjsip/src/pjsip/sip_transport_udp.c

Timestamp:

May 15, 2019 2:54:52 AM (5 years ago)

Author:

nanang

Message:

Re #2191: Fixed crash in SIP transport destroy due to bug introduced by r5971, i.e: group lock is set after registering tp to tpmgr, so tpmgr won't call pj_grp_lock_add_ref(), but in unregisteration, group lock is set, so tpmgr will call pj_grp_lock_dec_ref().

File:

• pjproject/trunk/pjsip/src/pjsip/sip_transport_udp.c (modified) (3 diffs)

pjproject/trunk/pjsip/src/pjsip/sip_transport_udp.c

@@ -471 +471 @@
     }
 
+    /* When creating this transport, reference count was incremented to flag
+     * this transport as permanent so it will not be destroyed by transport
+     * manager whenever idle. Application may or may not have cleared the
+     * flag (by calling pjsip_transport_dec_ref()), so in case it has not,
+     * let's do it now, so this transport can be destroyed.
+     */
+    if (pj_atomic_get(tp->base.ref_cnt) > 0)
+        pjsip_transport_dec_ref(&tp->base);
+
+    /* Destroy transport */
     if (tp->grp_lock) {
         pj_grp_lock_t *grp_lock = tp->grp_lock;
@@ -845 +855 @@
     tp->base.destroy = &udp_destroy;
 
-    /* This is a permanent transport, so we initialize the ref count
-     * to one so that transport manager don't destroy this transport
-     * when there's no user!
-     */
-    pj_atomic_inc(tp->base.ref_cnt);
-
     /* Register to transport manager. */
     tp->base.tpmgr = pjsip_endpt_get_tpmgr(endpt);
@@ -857 +861 @@
         goto on_error;
 
+    /* This is a permanent transport, so we initialize the ref count
+     * to one so that transport manager won't destroy this transport
+     * when there's no user!
+     */
+    pjsip_transport_add_ref(&tp->base);
 
     /* Create rdata and put it in the array. */