Skip to content
Snippets Groups Projects
  • Kevin Harwell's avatar
    6baa4b53
    AST-2020-001 - res_pjsip: Return dialog locked and referenced · 6baa4b53
    Kevin Harwell authored
    pjproject returns the dialog locked and with a reference. However,
    in Asterisk the method that handles this decrements the reference
    and removes the lock prior to returning. This makes it possible,
    under some circumstances, for another thread to free said dialog
    before the thread that created it attempts to use it again. Of
    course when the thread that created it tries to use a freed dialog
    a crash can occur.
    
    This patch makes it so Asterisk now returns the newly created
    dialog both locked, and with an added reference. This allows the
    caller to de-reference, and unlock the dialog when it is safe to
    do so.
    
    In the case of a new SIP Invite the lock, and reference are now
    held for the entirety of the new invite handling process.
    Otherwise it's possible for the dialog, or its dependent objects,
    like the transaction, to disappear. For example if there is a TCP
    transport error.
    
    ASTERISK-29057 #close
    
    Change-Id: I5ef645a47829596f402cf383dc02c629c618969e
    6baa4b53
    History
    AST-2020-001 - res_pjsip: Return dialog locked and referenced
    Kevin Harwell authored
    pjproject returns the dialog locked and with a reference. However,
    in Asterisk the method that handles this decrements the reference
    and removes the lock prior to returning. This makes it possible,
    under some circumstances, for another thread to free said dialog
    before the thread that created it attempts to use it again. Of
    course when the thread that created it tries to use a freed dialog
    a crash can occur.
    
    This patch makes it so Asterisk now returns the newly created
    dialog both locked, and with an added reference. This allows the
    caller to de-reference, and unlock the dialog when it is safe to
    do so.
    
    In the case of a new SIP Invite the lock, and reference are now
    held for the entirety of the new invite handling process.
    Otherwise it's possible for the dialog, or its dependent objects,
    like the transaction, to disappear. For example if there is a TCP
    transport error.
    
    ASTERISK-29057 #close
    
    Change-Id: I5ef645a47829596f402cf383dc02c629c618969e