diff options
| author | Mark Michelson <mmichelson@digium.com> | 2015-09-28 16:36:25 -0500 |
|---|---|---|
| committer | Richard Mudgett <rmudgett@digium.com> | 2015-10-22 16:16:56 -0500 |
| commit | ad395080957b33a17f6cfe2c83697bebef286c25 (patch) | |
| tree | 84e868184f0059f34c91972027bcfb7ef79dda73 /res/res_pjsip_pubsub.c | |
| parent | 067f40876001255aed9bf8b65567d1c25961aebd (diff) | |
res_pjsip_pubsub: Prevent crashes on final NOTIFY.
The SIP dialog is removed from the subscription tree when the final
NOTIFY is sent. However, after the final NOTIFY is sent, the persistence
update function still attempts to access the cseq from the dialog,
resulting in a crash.
This fix removes the subscription persistence at the same time that the
dialog is removed from the subscription tree. This way, there is no
attempt to update persistence when the subscription is being destroyed.
Change-Id: Ibb46977a6cef9c51dc95f40f43446e3d11eed5bb
Diffstat (limited to 'res/res_pjsip_pubsub.c')
| -rw-r--r-- | res/res_pjsip_pubsub.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/res/res_pjsip_pubsub.c b/res/res_pjsip_pubsub.c index bb2f24395..2391c883a 100644 --- a/res/res_pjsip_pubsub.c +++ b/res/res_pjsip_pubsub.c @@ -598,6 +598,7 @@ static void subscription_persistence_remove(struct sip_subscription_tree *sub_tr ast_sorcery_delete(ast_sip_get_sorcery(), sub_tree->persistence); ao2_ref(sub_tree->persistence, -1); + sub_tree->persistence = NULL; } @@ -1185,7 +1186,6 @@ static void subscription_tree_destructor(void *obj) remove_subscription(sub_tree); - subscription_persistence_remove(sub_tree); ao2_cleanup(sub_tree->endpoint); destroy_subscriptions(sub_tree->root); @@ -3289,6 +3289,7 @@ static void pubsub_on_evsub_state(pjsip_evsub *evsub, pjsip_event *event) ast_sip_dialog_set_serializer(sub_tree->dlg, NULL); ast_sip_dialog_set_endpoint(sub_tree->dlg, NULL); sub_tree->dlg = NULL; + subscription_persistence_remove(sub_tree); shutdown_subscriptions(sub_tree->root); /* Remove evsub's reference to the sub_tree */ |