kenmirrors/asterisk
1
0
Fork 0
mirror of https://github.com/asterisk/asterisk.git synced 2025-10-12 15:45:18 +00:00
Code Issues Packages Projects Releases Wiki Activity

PJSIP FAX: Fix T.38 automatic reject timer NULL channel pointer dereferences.

Browse Source 
When a caller calls a FAX number and then hangs up right after the call is
answered then the T.38 re-INVITE automatic reject timer may still be
running after the channel goes away.

* Added session NULL channel checks on the code paths that get executed by
t38_automatic_reject() to prevent a crash when the T.38 re-INVITE
automatic reject timer expires.

ASTERISK-25168
Reported by: Carl Fortin

Change-Id: I07b6cd23815aedce5044f8f32543779e2f7a2403
This commit is contained in:
Richard Mudgett
2015-06-26 10:36:19 -05:00
parent 3cdbe696a3
commit 792ed7ce93
2 changed files with 14 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
res/res_pjsip_session.c
View File

@@ -1039,7 +1039,10 @@ void ast_sip_session_resume_reinvite(struct ast_sip_session *session)
return;
}
pjsip_endpt_process_rx_data(ast_sip_get_pjsip_endpoint(), session->deferred_reinvite, NULL, NULL);
if (session->channel) {
pjsip_endpt_process_rx_data(ast_sip_get_pjsip_endpoint(),
session->deferred_reinvite, NULL, NULL);
}
pjsip_rx_data_free_cloned(session->deferred_reinvite);
session->deferred_reinvite = NULL;
}