diff options
| author | Benny Prijono <bennylp@teluu.com> | 2007-05-23 14:12:35 +0000 |
|---|---|---|
| committer | Benny Prijono <bennylp@teluu.com> | 2007-05-23 14:12:35 +0000 |
| commit | 538779756a6ccb5db942465436b337c66c6f2886 (patch) | |
| tree | 8c37f2882a67438cda753f900f2d40657bf19ed5 | |
| parent | 56c7bd079294662092a6570b68781b0f562b0bb6 (diff) | |
Fixed ticket #291: Free memory read in PUBLISH session
git-svn-id: http://svn.pjsip.org/repos/pjproject/trunk@1292 74dad513-b988-da41-8d7b-12977e46ad98
| -rw-r--r-- | pjsip/src/pjsip-simple/publishc.c | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/pjsip/src/pjsip-simple/publishc.c b/pjsip/src/pjsip-simple/publishc.c index 0cb15a76..6096622c 100644 --- a/pjsip/src/pjsip-simple/publishc.c +++ b/pjsip/src/pjsip-simple/publishc.c @@ -544,11 +544,18 @@ static void tsx_callback(void *token, pjsip_event *event) /* Call callback. */ if (expiration == 0xFFFF) expiration = -1; + + /* Temporarily increment pending_tsx to prevent callback from + * destroying pubc. + */ + ++pubc->pending_tsx; + call_callback(pubc, PJ_SUCCESS, tsx->status_code, (rdata ? &rdata->msg_info.msg->line.status.reason : pjsip_get_status_text(tsx->status_code)), rdata, expiration); + --pubc->pending_tsx; } /* Delete the record if user destroy pubc during the callback. */ |