]> git.ipfire.org Git - thirdparty/asterisk.git/commit
res_pjsip_transport_websocket: Prevent transport from being destroyed before message...
authorTinet-mucw <mucw@ti-net.com.cn>
Wed, 13 Sep 2023 09:12:12 +0000 (17:12 +0800)
committerAsterisk Development Team <asteriskteam@digium.com>
Fri, 12 Jan 2024 18:29:18 +0000 (18:29 +0000)
commita86376fe6824b59876f8dde4dd2348532bc5d6bc
tree59ab7b8a0d47632580814f8cfd8107d0e1d69555
parent3b61583c2036b9d8a9f9bf08cd21ec4c95f43a13
res_pjsip_transport_websocket: Prevent transport from being destroyed before message finishes.

From the gdb information, ast_websocket_read reads a message successfully,
then transport_read is called in the serializer. During execution of pjsip_transport_down,
ws_session->stream->fd is closed; ast_websocket_read encounters an error and exits the while loop.
After executing transport_shutdown, the transport's reference count becomes 0, causing a crash when sending SIP messages.
This was due to pjsip_transport_dec_ref executing earlier than pjsip_rx_data_clone, leading to this issue.
In websocket_cb executeing pjsip_transport_add_ref, this we now ensure the transport is not destroyed while in the loop.

Resolves: asterisk#299
(cherry picked from commit edc674a6cadea9ab9d8eaf82c962eaa9f92a08a5)
res/res_pjsip_transport_websocket.c