From: Richard Mudgett <rmudgett@digium.com>
Date: Thu, 30 Jul 2015 22:05:57 +0000 (-0500)
Subject: res_pjsip_session.c: Fix crashes seen when call cancelled.
X-Git-Tag: 13.6.0-rc1~109
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=13eb491e35ae6a99164dec6a62d7f05784c75c11;p=thirdparty%2Fasterisk.git

res_pjsip_session.c: Fix crashes seen when call cancelled.

Two testsuite tests crashed in the same place as a result of an INVITE
being CANCELed.

tests/channels/pjsip/resolver/srv/failover/in_dialog/transport_unspecified
tests/channels/pjsip/resolver/srv/failover/in_dialog/transport_tcp

The session pointer is no longer in the inv->mod_data[session_module.id]
location because the INVITE transaction has reached the terminated state.

ASTERISK-25297 #close
Reported by: Richard Mudgett

Change-Id: Idb75fdca0321f5447d5dac737a632a5f03614427
---

diff --git a/res/res_pjsip_session.c b/res/res_pjsip_session.c
index 5eb72b45af..539bfc1fa1 100644
--- a/res/res_pjsip_session.c
+++ b/res/res_pjsip_session.c
@@ -2681,8 +2681,10 @@ static void session_inv_on_media_update(pjsip_inv_session *inv, pj_status_t stat
 	struct ast_sip_session *session = inv->mod_data[session_module.id];
 	const pjmedia_sdp_session *local, *remote;
 
-	if (!session->channel) {
-		/* If we don't have a channel. We really don't care about media updates.
+	if (!session || !session->channel) {
+		/*
+		 * If we don't have a session or channel then we really
+		 * don't care about media updates.
 		 * Just ignore
 		 */
 		return;