Ticket #460 (closed defect: fixed)
Concurrency problem when destroying stream (thanks Michael Broughton)
|Reported by:||bennylp||Owned by:||bennylp|
|Backport to 1.x milestone:||Backported:|
I am looking at two functions in stream.c: pjmedia_stream_destroy and on_rx_rtp. I am trying to figure out if the following scenario is possible:
- Thread A calls pjmedia_stream_destroy, which locks stream->jb_mutex.
- Thread B calls on_rx_rtp, which tries to lock stream->jb_mutex but cannot right away because thread A already holds the lock.
- Thread A goes about it's work and then free's stream->jb_mutex.
- Thread B, still trying to lock stream->jb_mutex, segfaults because thread A deallocated stream->jb_mutex and zeroed out the pointer.
- Status changed from new to assigned
- Component changed from applications to pjmedia
- Summary changed from Concurrency problem when destroying stream to Concurrency problem when destroying stream (thanks Michael Broughton)
- Status changed from assigned to closed
- Resolution set to fixed