kenmirrors/asterisk
1
0
Fork 0
mirror of https://github.com/asterisk/asterisk.git synced 2025-10-03 19:16:46 +00:00
Code Issues Packages Projects Releases Wiki Activity

res_pjsip: Fix pointer use after unref.

Browse Source 
Change-Id: I4b6e1b0070563eeaee223cb58326f1b962ed5bc1
This commit is contained in:
Richard Mudgett
2017-04-10 11:30:35 -05:00
parent 304f652cda
commit aecf19e7d2
1 changed files with 9 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
res/res_pjsip/config_transport.c
View File

@@ -286,15 +286,16 @@ static struct internal_state *find_internal_state_by_transport(const struct ast_
static struct ast_sip_transport_state *find_state_by_transport(const struct ast_sip_transport *transport) static struct ast_sip_transport_state *find_state_by_transport(const struct ast_sip_transport *transport)
{ {
struct internal_state *state; struct internal_state *state;
struct ast_sip_transport_state *trans_state;
state = find_internal_state_by_transport(transport); state = find_internal_state_by_transport(transport);
if (!state) { if (!state) {
return NULL; return NULL;
} }
ao2_bump(state->state); trans_state = ao2_bump(state->state);
ao2_cleanup(state); ao2_ref(state, -1);
return state->state; return trans_state;
} }
static int remove_temporary_state(void) static int remove_temporary_state(void)
@@ -1297,22 +1298,22 @@ static struct ast_sip_cli_formatter_entry *cli_formatter;
struct ast_sip_transport_state *ast_sip_get_transport_state(const char *transport_id) struct ast_sip_transport_state *ast_sip_get_transport_state(const char *transport_id)
{ {
struct internal_state * state = NULL; struct internal_state *state = NULL;
struct ast_sip_transport_state *trans_state;
if (!transport_states) { if (!transport_states) {
return NULL; return NULL;
} }
state = ao2_find(transport_states, transport_id, OBJ_SEARCH_KEY); state = ao2_find(transport_states, transport_id, OBJ_SEARCH_KEY);
if (!state || !state->state) { if (!state) {
ao2_cleanup(state);
return NULL; return NULL;
} }
ao2_ref(state->state, +1); trans_state = ao2_bump(state->state);
ao2_ref(state, -1); ao2_ref(state, -1);
return state->state; return trans_state;
} }
static int populate_transport_states(void *obj, void *arg, int flags) static int populate_transport_states(void *obj, void *arg, int flags)