From 7bf6a01cfaa01cb653ec1a43499b4573b292f9de Mon Sep 17 00:00:00 2001 From: Kinsey Moore Date: Thu, 26 Apr 2012 13:31:16 +0000 Subject: Fix reference leaks involving SIP Replaces transfers The reference held for SIP blind transfers using the Replaces header in an INVITE was never freed on success and also failed to be freed in some error conditions. This caused a file descriptor leak since the RTP structures in use at the time of the transfer were never freed. This reference leak and another relating to subscriptions in the same code path have now been corrected. (closes issue ASTERISK-19579) ........ Merged revisions 363986 from http://svn.asterisk.org/svn/asterisk/branches/1.8 ........ Merged revisions 363987 from http://svn.asterisk.org/svn/asterisk/branches/10 git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@363988 65c4cc65-6c06-0410-ace0-fbb531ad65f3 --- channels/chan_sip.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/channels/chan_sip.c b/channels/chan_sip.c index 1f987e7d1..0d5930d61 100644 --- a/channels/chan_sip.c +++ b/channels/chan_sip.c @@ -5893,8 +5893,12 @@ void __sip_destroy(struct sip_pvt *p, int lockowner, int lockdialoglist) } if (p->udptl) ast_udptl_destroy(p->udptl); - if (p->refer) + if (p->refer) { + if (p->refer->refer_call) { + p->refer->refer_call = dialog_unref(p->refer->refer_call, "unref dialog p->refer->refer_call"); + } ast_free(p->refer); + } if (p->route) { free_old_route(p->route); p->route = NULL; @@ -23310,6 +23314,7 @@ static int handle_request_invite(struct sip_pvt *p, struct sip_request *req, int if (subscription->owner) { ast_channel_unlock(subscription->owner); } + subscription = dialog_unref(subscription, "unref dialog subscription"); } } @@ -23328,7 +23333,6 @@ static int handle_request_invite(struct sip_pvt *p, struct sip_request *req, int if (p->refer->refer_call == p) { ast_log(LOG_NOTICE, "INVITE with replaces into it's own call id (%s == %s)!\n", replace_id, p->callid); - p->refer->refer_call = dialog_unref(p->refer->refer_call, "unref dialog p->refer->refer_call"); transmit_response_reliable(p, "400 Bad request", req); /* The best way to not not accept the transfer */ error = 1; } @@ -23356,6 +23360,7 @@ static int handle_request_invite(struct sip_pvt *p, struct sip_request *req, int if (p->refer->refer_call->owner) { ast_channel_unlock(p->refer->refer_call->owner); } + p->refer->refer_call = dialog_unref(p->refer->refer_call, "unref dialog p->refer->refer_call"); } refer_locked = 0; p->invitestate = INV_COMPLETED; -- cgit v1.2.3