kenmirrors/asterisk
1
0
Fork 0
mirror of https://github.com/asterisk/asterisk.git synced 2025-10-03 11:11:05 +00:00
Code Issues Packages Projects Releases Wiki Activity

res_pjsip_pubsub: Fix reference to released endpoint

Browse Source 
destroy_subscription was attempting to get the id of the
subscription tree's endpoint after we'd already called ao2_cleanup
on it causing a segfault.

Moved the cleanup until after the debug statement and since
endpoint could also be NULL at this point, check for that as well.

ASTERISK-27057 #close
Reported-by: Ryan Smith

Change-Id: Ice0a7727f560cf204d870a774c6df71e159b1678
This commit is contained in:
George Joseph
2017-06-14 10:12:21 -06:00
parent e26d15fabb
commit c2eea791e4
1 changed files with 5 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
res/res_pjsip_pubsub.c
View File

@@ -1108,7 +1108,9 @@ static void remove_subscription(struct sip_subscription_tree *obj)
static void destroy_subscription(struct ast_sip_subscription *sub)
{
ast_debug(3, "Destroying SIP subscription from '%s->%s'\n",
ast_sorcery_object_get_id(sub->tree->endpoint), sub->resource);
sub->tree->endpoint ? ast_sorcery_object_get_id(sub->tree->endpoint) : "Unknown",
sub->resource);
ast_free(sub->body_text);
AST_VECTOR_FREE(&sub->children);
@@ -1265,14 +1267,14 @@ static void subscription_tree_destructor(void *obj)
sub_tree->endpoint ? ast_sorcery_object_get_id(sub_tree->endpoint) : "Unknown",
sub_tree->root ? sub_tree->root->resource : "Unknown");
ao2_cleanup(sub_tree->endpoint);
destroy_subscriptions(sub_tree->root);
if (sub_tree->dlg) {
ast_sip_push_task_synchronous(sub_tree->serializer, subscription_unreference_dialog, sub_tree);
}
ao2_cleanup(sub_tree->endpoint);
ast_taskprocessor_unreference(sub_tree->serializer);
ast_module_unref(ast_module_info->self);
}