diff options
author | Mark Michelson <mmichelson@digium.com> | 2014-12-08 16:43:00 +0000 |
---|---|---|
committer | Mark Michelson <mmichelson@digium.com> | 2014-12-08 16:43:00 +0000 |
commit | bba1763f4762112ba546234827f87c654e2a9b56 (patch) | |
tree | 96e0445bb75667fe57b2cfa8665a0bc2dca24f09 /include/asterisk/manager.h | |
parent | fe7671fee69b0ce1a6120a9ccb6664c5f31d37d3 (diff) |
Fix a crash that would occur when receiving a 491 response to a reinvite.
The reviewboard description does a fine job of summarizing this, so here it is:
A reporter discovered that Asterisk would crash when attempting to retransmit
a reinvite that had previously received a 491 response. The crash occurred
because a pjsip_tx_data structure was being saved for reuse, but its reference
count was not being increased. The result was that the pjsip_tx_data was being
freed before we were actually done with it. When we attempted to re-use the
structure when re-sending the reinvite, Asterisk would crash.
The fix implemented here is not to try holding onto the pjsip_tx_data at all.
Instead, when we reschedule sending the reinvite, we create a brand new
pjsip_tx_data and send that instead. Because of this change, there is no need
for an ast_sip_session_delayed_request structure to have a pjsip_tx_data on
it any more. So any code referencing its use has been removed.
When this initial fix was introduced, I encountered a second crash when
processing a subsequent 200 OK on a rescheduled reinvite. The reason was
that when rescheduling the reinvite, we gave the wrong location for a
response callback. This has been fixed in this patch as well.
ASTERISK-24556 #close
Reported by Abhay Gupta
Review: https://reviewboard.asterisk.org/r/4233
........
Merged revisions 429089 from http://svn.asterisk.org/svn/asterisk/branches/13
git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@429090 65c4cc65-6c06-0410-ace0-fbb531ad65f3
Diffstat (limited to 'include/asterisk/manager.h')
0 files changed, 0 insertions, 0 deletions