From: Kevin Harwell <kharwell@digium.com>
Date: Thu, 10 Oct 2019 20:30:06 +0000 (-0500)
Subject: res_pjsip_mwi: potential double unref, and potential unwanted double link
X-Git-Tag: 13.29.1~1^2
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=2f6504ce5ea5fda21d23623e0d4f390337686baa;p=thirdparty%2Fasterisk.git

res_pjsip_mwi: potential double unref, and potential unwanted double link

When creating an unsolicited MWI aggregate subscription it was possible for
the subscription object to be double unref'ed. This patch removes the explicit
unref as it is not needed since the RAII_VAR will handle it at function end.

Less concerning there was also a bug that could potentially allow the aggregate
subscription object to be added to the unsolicited container twice. This patch
ensures it is added only once.

ASTERISK-28575

Change-Id: I9ccfdb5ea788bc0c3618db183aae235e53c12763
---

diff --git a/res/res_pjsip_mwi.c b/res/res_pjsip_mwi.c
index 46f890beb3..d6bed74be8 100644
--- a/res/res_pjsip_mwi.c
+++ b/res/res_pjsip_mwi.c
@@ -1289,6 +1289,13 @@ static int create_unsolicited_mwi_subscriptions(struct ast_sip_endpoint *endpoin
 			if (!aggregate_sub) {
 				return 0; /* No MWI aggregation for you */
 			}
+
+			/*
+			 * Just in case we somehow get in the position of recreating with no previous
+			 * aggregate object, set recreate to false here in order to allow the new
+			 * object to be linked into the container below
+			 */
+			recreate = 0;
 		}
 	}
 
@@ -1330,13 +1337,13 @@ static int create_unsolicited_mwi_subscriptions(struct ast_sip_endpoint *endpoin
 
 	if (aggregate_sub) {
 		if (ao2_container_count(aggregate_sub->stasis_subs)) {
-			ao2_link_flags(unsolicited_mwi, aggregate_sub, OBJ_NOLOCK);
+			/* Only link if we're dealing with a new aggregate object */
+			if (!recreate) {
+				ao2_link_flags(unsolicited_mwi, aggregate_sub, OBJ_NOLOCK);
+			}
 			if (send_now && sub_added) {
 				send_notify(aggregate_sub, NULL, 0);
 			}
-		} else {
-			/* No stasis subscriptions then no MWI data to aggregate */
-			ao2_ref(aggregate_sub, -1);
 		}
 	}