Fix a crash due to the INVITE session being destroyed before the session.

This change ensures that the INVITE session remains valid for the lifetime
of the session object itself by increasing the session count on the dialog that
the INVITE session is allocated from. Once this reaches zero (normally as a result
of decrementing it within the session destructor) the dialog, and INVITE session,
are destroyed.

git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@389609 65c4cc65-6c06-0410-ace0-fbb531ad65f3

diff --git a/res/res_sip_session.c b/res/res_sip_session.c
index 4629cf0a97cde6dba3d26245e11571512a46b5c7..5613078b9efd1162d003ffff4cdeea627419e1f9 100644 (file)
--- a/res/res_sip_session.c
+++ b/res/res_sip_session.c
@@ -887,6 +887,10 @@ static void session_destructor(void *obj)
        ast_party_id_free(&session->id);
        ao2_cleanup(session->endpoint);
        ast_format_cap_destroy(session->req_caps);
+
+       if (session->inv_session) {
+               pjsip_dlg_dec_session(session->inv_session->dlg, &session_module);
+       }
 }
 
 static int add_supplements(struct ast_sip_session *session)
@@ -945,6 +949,7 @@ struct ast_sip_session *ast_sip_session_alloc(struct ast_sip_endpoint *endpoint,
        }
        ast_sip_dialog_set_serializer(inv_session->dlg, session->serializer);
        ast_sip_dialog_set_endpoint(inv_session->dlg, endpoint);
+       pjsip_dlg_inc_session(inv_session->dlg, &session_module);
        ao2_ref(endpoint, +1);
        inv_session->mod_data[session_module.id] = session;
        session->endpoint = endpoint;