]> git.ipfire.org Git - thirdparty/asterisk.git/commit
res/res_pjsip: Fix crash due to misuse of session->media between threads.
authorPaulo Vicentini <paulo.vicentini@gmail.com>
Thu, 8 Nov 2018 10:21:03 +0000 (11:21 +0100)
committerPaulo Vicentini <paulo.vicentini@gmail.com>
Wed, 23 Jan 2019 11:46:08 +0000 (12:46 +0100)
commitc01d2f66ee13aae1cd768a41b67462afa12808f6
treead535b24b9ae634db155a765c0ebfb2001e1e31e
parent2c1ac524b8220d2f671bedf1245734fb7400c4bb
res/res_pjsip: Fix crash due to misuse of session->media between threads.

This patch makes sure that thread running ast_taskprocessor_execute
cannot suddenly dispose the session->media object making the other
threads (running pbx_thread / bridge_channel_ind_thread) crash when they
try to access the pointer to invalid memory. We were experiencing a crash due
to a misuse of session->media container between threads running
(bridge_channel_ind_thread/pbx_thread) and the thread running
ast_taskprocessor_execute. Depending on the SIP flow (during a disconnection)
and the threads' code path, the session->media container was being destroyed
(and set to NULL) by the thread running ast_taskprocessor_execute while the
thread running t38_framehook_read was still referring to it.
Now res_pjsip_t38 is referring a session_media in a datastore.

ASTERISK-28156

Change-Id: Ia92e2389b8d804bf205473e92ec06217e87ce237
res/res_pjsip_t38.c