From 538779756a6ccb5db942465436b337c66c6f2886 Mon Sep 17 00:00:00 2001 From: Benny Prijono Date: Wed, 23 May 2007 14:12:35 +0000 Subject: Fixed ticket #291: Free memory read in PUBLISH session git-svn-id: http://svn.pjsip.org/repos/pjproject/trunk@1292 74dad513-b988-da41-8d7b-12977e46ad98 --- pjsip/src/pjsip-simple/publishc.c | 7 +++++++ 1 file changed, 7 insertions(+) (limited to 'pjsip/src/pjsip-simple/publishc.c') diff --git a/pjsip/src/pjsip-simple/publishc.c b/pjsip/src/pjsip-simple/publishc.c index 0cb15a76..6096622c 100644 --- a/pjsip/src/pjsip-simple/publishc.c +++ b/pjsip/src/pjsip-simple/publishc.c @@ -544,11 +544,18 @@ static void tsx_callback(void *token, pjsip_event *event) /* Call callback. */ if (expiration == 0xFFFF) expiration = -1; + + /* Temporarily increment pending_tsx to prevent callback from + * destroying pubc. + */ + ++pubc->pending_tsx; + call_callback(pubc, PJ_SUCCESS, tsx->status_code, (rdata ? &rdata->msg_info.msg->line.status.reason : pjsip_get_status_text(tsx->status_code)), rdata, expiration); + --pubc->pending_tsx; } /* Delete the record if user destroy pubc during the callback. */ -- cgit v1.2.3