Fixed #1807: Crash when shutting down library while having subscription transactions on going.

git-svn-id: http://svn.pjsip.org/repos/pjproject/trunk@4969 74dad513-b988-da41-8d7b-12977e46ad98

1 files changed, 13 insertions, 0 deletions

diff --git a/pjsip/src/pjsip-simple/evsub.c b/pjsip/src/pjsip-simple/evsub.c
index 530f418e..650901d8 100644
--- a/pjsip/src/pjsip-simple/evsub.c
+++ b/pjsip/src/pjsip-simple/evsub.c
@@ -234,6 +234,7 @@ struct pjsip_evsub
     pj_timer_entry	  timer;	/**< Internal timer.		    */
     int			  pending_tsx;	/**< Number of pending transactions.*/
     pjsip_transaction	 *pending_sub;	/**< Pending UAC SUBSCRIBE tsx.	    */
+    pj_timer_entry	 *pending_sub_timer; /**< Stop pending sub timer.   */
 
     void		 *mod_data[PJSIP_MAX_MODULE];	/**< Module data.   */
 };
@@ -535,6 +536,13 @@ static void evsub_destroy( pjsip_evsub *sub )
     /* Kill timer */
     set_timer(sub, TIMER_TYPE_NONE, 0);
 
+    /* Kill timer for stopping pending sub (see ticket #1807) */
+    if (sub->pending_sub_timer && sub->pending_sub_timer->id == 1) {
+	pjsip_endpt_cancel_timer(sub->endpt, sub->pending_sub_timer);
+	sub->pending_sub_timer->id = 0;
+	sub->pending_sub_timer = NULL;
+    }
+
     /* Remove this session from dialog's list of subscription */
     dlgsub_head = (struct dlgsub *) sub->dlg->mod_data[mod_evsub.mod.id];
     dlgsub = dlgsub_head->next;
@@ -1349,6 +1357,9 @@ static void terminate_timer_cb(pj_timer_heap_t *timer_heap,
 
     PJ_UNUSED_ARG(timer_heap);
 
+    /* Clear timer ID */
+    entry->id = 0;
+
     key = (pj_str_t*)entry->user_data;
     tsx = pjsip_tsx_layer_find_tsx(key, PJ_FALSE);
     /* Chance of race condition here */
@@ -1570,6 +1581,8 @@ static pjsip_evsub *on_new_transaction( pjsip_transaction *tsx,
 	    pj_strdup(dlg->pool, key, &sub->pending_sub->transaction_key);
 	    timer->cb = &terminate_timer_cb;
 	    timer->user_data = key;
+	    timer->id = 1;
+	    sub->pending_sub_timer = timer;
 
 	    pjsip_endpt_schedule_timer(dlg->endpt, timer, &timeout);
 	}