Merge "res_pjsip_outbound_publish: Ref leak in off nominal callback paths" into 13

This commit is contained in:
Joshua Colp
2016-05-19 05:56:31 -05:00
committed by Gerrit Code Review

View File

@@ -883,6 +883,11 @@ static int sip_outbound_publish_client_alloc(void *data)
/*! \brief Callback function for publish client responses */ /*! \brief Callback function for publish client responses */
static void sip_outbound_publish_callback(struct pjsip_publishc_cbparam *param) static void sip_outbound_publish_callback(struct pjsip_publishc_cbparam *param)
{ {
#define DESTROY_CLIENT() do { \
pjsip_publishc_destroy(client->client); \
client->client = NULL; \
ao2_ref(client, -1); } while (0)
RAII_VAR(struct ast_sip_outbound_publish_client *, client, ao2_bump(param->token), ao2_cleanup); RAII_VAR(struct ast_sip_outbound_publish_client *, client, ao2_bump(param->token), ao2_cleanup);
RAII_VAR(struct ast_sip_outbound_publish *, publish, ao2_bump(client->publish), ao2_cleanup); RAII_VAR(struct ast_sip_outbound_publish *, publish, ao2_bump(client->publish), ao2_cleanup);
SCOPED_AO2LOCK(lock, client); SCOPED_AO2LOCK(lock, client);
@@ -900,8 +905,7 @@ static void sip_outbound_publish_callback(struct pjsip_publishc_cbparam *param)
ao2_ref(client, -1); ao2_ref(client, -1);
} }
/* Once the destroy is called this callback will not get called any longer, so drop the client ref */ /* Once the destroy is called this callback will not get called any longer, so drop the client ref */
pjsip_publishc_destroy(client->client); DESTROY_CLIENT();
ao2_ref(client, -1);
return; return;
} }
@@ -919,9 +923,7 @@ static void sip_outbound_publish_callback(struct pjsip_publishc_cbparam *param)
client->auth_attempts++; client->auth_attempts++;
if (client->auth_attempts == publish->max_auth_attempts) { if (client->auth_attempts == publish->max_auth_attempts) {
pjsip_publishc_destroy(client->client); DESTROY_CLIENT();
client->client = NULL;
ast_log(LOG_ERROR, "Reached maximum number of PUBLISH authentication attempts on outbound publish '%s'\n", ast_log(LOG_ERROR, "Reached maximum number of PUBLISH authentication attempts on outbound publish '%s'\n",
ast_sorcery_object_get_id(publish)); ast_sorcery_object_get_id(publish));
@@ -933,9 +935,7 @@ static void sip_outbound_publish_callback(struct pjsip_publishc_cbparam *param)
client->auth_attempts = 0; client->auth_attempts = 0;
if (param->code == 412) { if (param->code == 412) {
pjsip_publishc_destroy(client->client); DESTROY_CLIENT();
client->client = NULL;
if (sip_outbound_publish_client_alloc(client)) { if (sip_outbound_publish_client_alloc(client)) {
ast_log(LOG_ERROR, "Failed to create a new outbound publish client for '%s' on 412 response\n", ast_log(LOG_ERROR, "Failed to create a new outbound publish client for '%s' on 412 response\n",
ast_sorcery_object_get_id(publish)); ast_sorcery_object_get_id(publish));
@@ -950,10 +950,9 @@ static void sip_outbound_publish_callback(struct pjsip_publishc_cbparam *param)
expires = pjsip_msg_find_hdr(param->rdata->msg_info.msg, PJSIP_H_MIN_EXPIRES, NULL); expires = pjsip_msg_find_hdr(param->rdata->msg_info.msg, PJSIP_H_MIN_EXPIRES, NULL);
if (!expires || !expires->ivalue) { if (!expires || !expires->ivalue) {
DESTROY_CLIENT();
ast_log(LOG_ERROR, "Received 423 response on outbound publish '%s' without a Min-Expires header\n", ast_log(LOG_ERROR, "Received 423 response on outbound publish '%s' without a Min-Expires header\n",
ast_sorcery_object_get_id(publish)); ast_sorcery_object_get_id(publish));
pjsip_publishc_destroy(client->client);
client->client = NULL;
goto end; goto end;
} }