From: Joshua Colp <jcolp@digium.com>
Date: Sat, 26 Oct 2013 12:55:11 +0000 (+0000)
Subject: chan_pjsip: Fix a crash when direct media is enabled and an ACK is received after... 
X-Git-Tag: 12.0.0-beta2~78
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=23be89dfff6a73cd8ac09ed988c4e7de9864c160;p=thirdparty%2Fasterisk.git

chan_pjsip: Fix a crash when direct media is enabled and an ACK is received after the channel is hung up.

(closes issue ASTERISK-22731)
Reported by: Kinsey Moore


git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/12@402064 65c4cc65-6c06-0410-ace0-fbb531ad65f3
---

diff --git a/channels/chan_pjsip.c b/channels/chan_pjsip.c
index 6ceece4fcc..8eb6be38b4 100644
--- a/channels/chan_pjsip.c
+++ b/channels/chan_pjsip.c
@@ -2046,7 +2046,7 @@ static void chan_pjsip_incoming_response(struct ast_sip_session *session, struct
 static int chan_pjsip_incoming_ack(struct ast_sip_session *session, struct pjsip_rx_data *rdata)
 {
 	if (rdata->msg_info.msg->line.req.method.id == PJSIP_ACK_METHOD) {
-		if (session->endpoint->media.direct_media.enabled) {
+		if (session->endpoint->media.direct_media.enabled && session->channel) {
 			ast_queue_control(session->channel, AST_CONTROL_SRCCHANGE);
 		}
 	}
diff --git a/include/asterisk/res_pjsip_session.h b/include/asterisk/res_pjsip_session.h
index 2df2262ad6..7b359cdf1f 100644
--- a/include/asterisk/res_pjsip_session.h
+++ b/include/asterisk/res_pjsip_session.h
@@ -190,6 +190,9 @@ struct ast_sip_session_supplement {
 	 * The reason is that the rdata passed into this function is a cloned rdata structure,
 	 * and its module data is not copied during the cloning operation.
 	 * If you need to get the dialog, you can get it via session->inv_session->dlg.
+	 *
+	 * \note
+	 * There is no guarantee that a channel will be present on the session when this is called.
      */
     int (*incoming_request)(struct ast_sip_session *session, struct pjsip_rx_data *rdata);
     /*! 
@@ -203,6 +206,9 @@ struct ast_sip_session_supplement {
 	 * The reason is that the rdata passed into this function is a cloned rdata structure,
 	 * and its module data is not copied during the cloning operation.
 	 * If you need to get the dialog, you can get it via session->inv_session->dlg.
+	 *
+	 * \note
+	 * There is no guarantee that a channel will be present on the session when this is called.
 	 */
     void (*incoming_response)(struct ast_sip_session *session, struct pjsip_rx_data *rdata);
     /*!