From 8ebbfa86a3ef8870a8c779233d6c2dbc31ccedae Mon Sep 17 00:00:00 2001 From: Nanang Izzuddin Date: Fri, 19 Jun 2015 14:43:34 +0000 Subject: Fixed #1859: Increment tsx group lock counter before send operation and decrement later in tsx's send_msg_callback() to avoid tsx premature destroy. git-svn-id: http://svn.pjsip.org/repos/pjproject/trunk@5111 74dad513-b988-da41-8d7b-12977e46ad98 --- pjsip/src/pjsip/sip_transaction.c | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) (limited to 'pjsip/src') diff --git a/pjsip/src/pjsip/sip_transaction.c b/pjsip/src/pjsip/sip_transaction.c index c0e57a0f..0174fa53 100644 --- a/pjsip/src/pjsip/sip_transaction.c +++ b/pjsip/src/pjsip/sip_transaction.c @@ -1795,11 +1795,17 @@ static void send_msg_callback( pjsip_send_state *send_state, tdata->mod_data[mod_tsx_layer.mod.id] == NULL) { *cont = PJ_FALSE; + + /* Decrease pending send counter */ + pj_grp_lock_dec_ref(tsx->grp_lock); return; } pj_grp_lock_acquire(tsx->grp_lock); + /* Decrease pending send counter */ + pj_grp_lock_dec_ref(tsx->grp_lock); + /* Reset */ tdata->mod_data[mod_tsx_layer.mod.id] = NULL; tsx->pending_tx = NULL; @@ -1932,6 +1938,11 @@ static void send_msg_callback( pjsip_send_state *send_state, /* Put again pending tdata */ tdata->mod_data[mod_tsx_layer.mod.id] = tsx; tsx->pending_tx = tdata; + + /* Increment group lock again for the next sending retry, + * to prevent us from being destroyed prematurely (ticket #1859). + */ + pj_grp_lock_add_ref(tsx->grp_lock); } } @@ -2122,6 +2133,11 @@ static pj_status_t tsx_send_msg( pjsip_transaction *tsx, tdata->mod_data[mod_tsx_layer.mod.id] = tsx; tsx->pending_tx = tdata; + /* Increment group lock while waiting for send operation to complete, + * to prevent us from being destroyed prematurely (ticket #1859). + */ + pj_grp_lock_add_ref(tsx->grp_lock); + /* Begin resolving destination etc to send the message. */ if (tdata->msg->type == PJSIP_REQUEST_MSG) { @@ -2131,6 +2147,7 @@ static pj_status_t tsx_send_msg( pjsip_transaction *tsx, if (status == PJ_EPENDING) status = PJ_SUCCESS; if (status != PJ_SUCCESS) { + pj_grp_lock_dec_ref(tsx->grp_lock); pjsip_tx_data_dec_ref(tdata); tdata->mod_data[mod_tsx_layer.mod.id] = NULL; tsx->pending_tx = NULL; -- cgit v1.2.3