Fix issues with skinny sessions

Fixes a couple of issues with the way skinny handles sessions by ensuring
sessions aren't used after being freed. Some other minor changes.

Review: https://reviewboard.asterisk.org/r/2272/

git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/11@379582 65c4cc65-6c06-0410-ace0-fbb531ad65f3

diff --git a/channels/chan_skinny.c b/channels/chan_skinny.c
index ea213e9e9c678be896abe5e30e5d31a5f2ff8866..fd67706bae631e2313923a7a144550cdbe1aacdd 100644 (file)
--- a/channels/chan_skinny.c
+++ b/channels/chan_skinny.c
@@ -6820,15 +6820,21 @@ static void destroy_session(struct skinnysession *s)
        AST_LIST_TRAVERSE_SAFE_BEGIN(&sessions, cur, list) {
                if (cur == s) {
                        AST_LIST_REMOVE_CURRENT(list);
-                       if (s->fd > -1) 
+                       if (s->fd > -1) {
                                close(s->fd);
-                       
-                       if (!s->device)
+                       }
+
+                       if (s->device) {
+                               s->device->session = NULL;
+                       } else {
                                ast_atomic_fetchadd_int(&unauth_sessions, -1);
+                       }
 
                        ast_mutex_destroy(&s->lock);
-                       
+
                        ast_free(s);
+
+                       break;
                }
        }
        AST_LIST_TRAVERSE_SAFE_END
@@ -6966,21 +6972,22 @@ static void *skinny_session(void *data)
                res = get_input(s);
                if (res < 0) {
                        ast_verb(3, "Ending Skinny session from %s (bad input)\n", ast_inet_ntoa(s->sin.sin_addr));
-                       break;
+                       destroy_session(s);
+                       return NULL;
                }
 
                if (res > 0)
                {
                        if (!(req = skinny_req_parse(s))) {
-                               destroy_session(s);
                                ast_verb(3, "Ending Skinny session from %s (failed parse)\n", ast_inet_ntoa(s->sin.sin_addr));
+                               destroy_session(s);
                                return NULL;
                        }
 
                        res = handle_message(req, s);
                        if (res < 0) {
-                               destroy_session(s);
                                ast_verb(3, "Ending Skinny session from %s\n", ast_inet_ntoa(s->sin.sin_addr));
+                               destroy_session(s);
                                return NULL;
                        }
                }