From a408369bac5dbbea8fa52f3fe8f4aa13bc323e5e Mon Sep 17 00:00:00 2001
From: Joshua Colp <jcolp@digium.com>
Date: Mon, 24 Aug 2015 13:04:57 -0300
Subject: [PATCH] res_pjsip_pubsub: On recreated notify fail deleted sub_tree
 is referenced

When recreating a subscription it is possible for a freed sub_tree
to be referenced when the initial NOTIFY fails to be created.

Change-Id: I681c215309aad01b21d611c2de47b3b0a6022788
---
 res/res_pjsip_pubsub.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/res/res_pjsip_pubsub.c b/res/res_pjsip_pubsub.c
index 57c85a4c73..2b42ad6be2 100644
--- a/res/res_pjsip_pubsub.c
+++ b/res/res_pjsip_pubsub.c
@@ -1393,8 +1393,9 @@ static int subscription_persistence_recreate(void *obj, void *arg, int flags)
 		subscription_persistence_update(sub_tree, &rdata);
 		if (generate_initial_notify(sub_tree->root)) {
 			pjsip_evsub_terminate(sub_tree->evsub, PJ_TRUE);
+		} else {
+			send_notify(sub_tree, 1);
 		}
-		send_notify(sub_tree, 1);
 	} else {
 		ast_sorcery_delete(ast_sip_get_sorcery(), persistence);
 	}
-- 
GitLab