diff options
| author | Richard Mudgett <rmudgett@digium.com> | 2015-06-26 10:36:19 -0500 |
|---|---|---|
| committer | Richard Mudgett <rmudgett@digium.com> | 2015-07-06 16:15:12 -0500 |
| commit | 792ed7ce93205fc700b3923640fa023b34eff5cb (patch) | |
| tree | 20ea15d2431c4b3de1e414c33fd07ce375044113 /res/res_pjsip_session.c | |
| parent | 3cdbe696a3f98f345cdeb739cb738f41cb830c15 (diff) | |
PJSIP FAX: Fix T.38 automatic reject timer NULL channel pointer dereferences.
When a caller calls a FAX number and then hangs up right after the call is
answered then the T.38 re-INVITE automatic reject timer may still be
running after the channel goes away.
* Added session NULL channel checks on the code paths that get executed by
t38_automatic_reject() to prevent a crash when the T.38 re-INVITE
automatic reject timer expires.
ASTERISK-25168
Reported by: Carl Fortin
Change-Id: I07b6cd23815aedce5044f8f32543779e2f7a2403
Diffstat (limited to 'res/res_pjsip_session.c')
| -rw-r--r-- | res/res_pjsip_session.c | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/res/res_pjsip_session.c b/res/res_pjsip_session.c index c72959400..84c343d3c 100644 --- a/res/res_pjsip_session.c +++ b/res/res_pjsip_session.c @@ -1039,7 +1039,10 @@ void ast_sip_session_resume_reinvite(struct ast_sip_session *session) return; } - pjsip_endpt_process_rx_data(ast_sip_get_pjsip_endpoint(), session->deferred_reinvite, NULL, NULL); + if (session->channel) { + pjsip_endpt_process_rx_data(ast_sip_get_pjsip_endpoint(), + session->deferred_reinvite, NULL, NULL); + } pjsip_rx_data_free_cloned(session->deferred_reinvite); session->deferred_reinvite = NULL; } |