From 04088ae49a729672ab63a6f616b00c34498c22b3 Mon Sep 17 00:00:00 2001 From: Liong Sauw Ming Date: Tue, 5 Mar 2013 06:29:15 +0000 Subject: Re #1616: Fixed assertion trying to release group lock when STUN transaction is already destroyed in the callback git-svn-id: http://svn.pjsip.org/repos/pjproject/trunk@4413 74dad513-b988-da41-8d7b-12977e46ad98 --- pjnath/src/pjnath/stun_transaction.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) (limited to 'pjnath') diff --git a/pjnath/src/pjnath/stun_transaction.c b/pjnath/src/pjnath/stun_transaction.c index 390f67f7..33fccea4 100644 --- a/pjnath/src/pjnath/stun_transaction.c +++ b/pjnath/src/pjnath/stun_transaction.c @@ -342,6 +342,9 @@ static void retransmit_timer_callback(pj_timer_heap_t *timer_heap, pj_grp_lock_acquire(tsx->grp_lock); if (tsx->transmit_count >= PJ_STUN_MAX_TRANSMIT_COUNT) { + /* tsx may be destroyed when calling the callback below */ + pj_grp_lock_t *grp_lock = tsx->grp_lock; + /* Retransmission count exceeded. Transaction has failed */ tsx->retransmit_timer.id = 0; PJ_LOG(4,(tsx->obj_name, "STUN timeout waiting for response")); @@ -352,7 +355,7 @@ static void retransmit_timer_callback(pj_timer_heap_t *timer_heap, tsx->cb.on_complete(tsx, PJNATH_ESTUNTIMEDOUT, NULL, NULL, 0); } } - pj_grp_lock_release(tsx->grp_lock); + pj_grp_lock_release(grp_lock); /* We might have been destroyed, don't try to access the object */ pj_log_pop_indent(); return; -- cgit v1.2.3