AST-2012-010: Clean up after a reinvite that never gets a final response

The basic problem is that if a re-INVITE is sent by Asterisk and it receives a
provisional response, but no final response, then the dialog is never torn
down. In addition to leaking memory, this also leaks file descriptors and will
eventually lead to Asterisk no longer being able to process calls.

This patch just keeps track of whether there is an outstanding re-INVITE, and if
there is goes ahead and cleans up everything as though there was no outstanding
reinvite.

Review: https://reviewboard.asterisk.org/r/2009/

(closes issue ASTERISK-19992)
Reported by: Steve Davies
Tested by: Steve Davies, Terry Wilson

git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/1.8@369436 65c4cc65-6c06-0410-ace0-fbb531ad65f3

diff --git a/channels/chan_sip.c b/channels/chan_sip.c
index ca1b2015eac1a51a39b689ab5eda3db711244239..1eda77ad34e218adb11b7a922eed9b6fc12de535 100644 (file)
--- a/channels/chan_sip.c
+++ b/channels/chan_sip.c
@@ -6350,7 +6350,7 @@ static int sip_hangup(struct ast_channel *ast)
                                stop_session_timer(p);
                        }
 
-                       if (!p->pendinginvite) {
+                       if (!p->pendinginvite || p->ongoing_reinvite) {
                                struct ast_channel *bridge = ast_bridged_channel(oldowner);
                                char quality_buf[AST_MAX_USER_FIELD], *quality;
 
@@ -11889,7 +11889,7 @@ static int transmit_reinvite_with_sdp(struct sip_pvt *p, int t38version, int old
        initialize_initreq(p, &req);
        p->lastinvite = p->ocseq;
        ast_set_flag(&p->flags[0], SIP_OUTGOING);       /* Change direction of this dialog */
-
+       p->ongoing_reinvite = 1;
        return send_request(p, &req, XMIT_CRITICAL, p->ocseq);
 }
 
@@ -20092,8 +20092,12 @@ static void handle_response_invite(struct sip_pvt *p, int resp, const char *rest
                p->invitestate = INV_COMPLETED;
        
        /* Final response, clear out pending invite */
-       if ((resp == 200 || resp >= 300) && p->pendinginvite && seqno == p->pendinginvite)
+       if ((resp == 200 || resp >= 300) && p->pendinginvite && seqno == p->pendinginvite) {
                p->pendinginvite = 0;
+               if (reinvite) {
+                       p->ongoing_reinvite = 0;
+               }
+       }
 
        /* If this is a response to our initial INVITE, we need to set what we can use
         * for this peer.

diff --git a/channels/sip/include/sip.h b/channels/sip/include/sip.h
index 8f352fab1426736a336b64d9f2befe6124625092..3c6ea280427a491049203614c7c34aaaffa4f0d8 100644 (file)
--- a/channels/sip/include/sip.h
+++ b/channels/sip/include/sip.h
@@ -1056,6 +1056,7 @@ struct sip_pvt {
        struct sip_auth_container *peerauth;/*!< Realm authentication credentials */
        int noncecount;                     /*!< Nonce-count */
        unsigned int stalenonce:1;          /*!< Marks the current nonce as responded too */
+       unsigned int ongoing_reinvite:1;    /*!< There is a reinvite in progress that might need to be cleaned up */
        char lastmsg[256];                  /*!< Last Message sent/received */
        int amaflags;                       /*!< AMA Flags */
        uint32_t pendinginvite; /*!< Any pending INVITE or state NOTIFY (in subscribe pvt's) ? (seqno of this) */