From e914af2a02fbace89608ca2a72ea990ec8fbb1f5 Mon Sep 17 00:00:00 2001 From: Benny Prijono Date: Thu, 5 Jul 2012 07:02:50 +0000 Subject: Re #1548: Crash due to racing condition in timer when call is disconnected quickly (thanks Joshua Colp for the report!) git-svn-id: http://svn.pjsip.org/repos/pjproject/trunk@4196 74dad513-b988-da41-8d7b-12977e46ad98 --- pjnath/include/pjnath/ice_session.h | 1 + pjnath/src/pjnath/ice_session.c | 10 ++++++++++ 2 files changed, 11 insertions(+) (limited to 'pjnath') diff --git a/pjnath/include/pjnath/ice_session.h b/pjnath/include/pjnath/ice_session.h index cf153728..f48e12d4 100644 --- a/pjnath/include/pjnath/ice_session.h +++ b/pjnath/include/pjnath/ice_session.h @@ -619,6 +619,7 @@ struct pj_ice_sess pj_uint8_t *prefs; /**< Type preference. */ pj_bool_t is_nominating; /**< Nominating stage */ pj_bool_t is_complete; /**< Complete? */ + pj_bool_t is_destroying; /**< Destroy is called */ pj_status_t ice_status; /**< Error status. */ pj_timer_entry timer; /**< ICE timer. */ pj_ice_sess_cb cb; /**< Callback. */ diff --git a/pjnath/src/pjnath/ice_session.c b/pjnath/src/pjnath/ice_session.c index bf94e545..40e10d55 100644 --- a/pjnath/src/pjnath/ice_session.c +++ b/pjnath/src/pjnath/ice_session.c @@ -455,6 +455,8 @@ static void destroy_ice(pj_ice_sess *ice, LOG4((ice->obj_name, "Destroying ICE session")); } + ice->is_destroying = PJ_TRUE; + /* Let other callbacks finish */ if (ice->mutex) { pj_mutex_lock(ice->mutex); @@ -1840,8 +1842,16 @@ static pj_status_t start_periodic_check(pj_timer_heap_t *th, ice = td->ice; clist = td->clist; + if (ice->is_destroying) + return PJ_SUCCESS; + pj_mutex_lock(ice->mutex); + if (ice->is_destroying) { + pj_mutex_unlock(ice->mutex); + return PJ_SUCCESS; + } + /* Set timer ID to FALSE first */ te->id = PJ_FALSE; -- cgit v1.2.3