From: Corey Farrell <git@cfware.com>
Date: Thu, 24 Jul 2014 17:56:51 +0000 (+0000)
Subject: chan_sip: sip_subscribe_mwi_destroy should not call sip_destroy
X-Git-Tag: 11.12.0-rc1~12
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=aaa44d6ea5179bda77205df923d2286c70102e14;p=thirdparty%2Fasterisk.git

chan_sip: sip_subscribe_mwi_destroy should not call sip_destroy

sip_subscribe_mwi_destroy calls sip_destroy on the reference counted
mwi->call.  This results in the fields of mwi->call being freed, but
mwi->call itself it leaked.  If other code is still using mwi->call
it can cause problems.  This change uses dialog_unref instead, to
balance the ref provided by sip_alloc().

ASTERISK-24087 #close
Reported by: Corey Farrell
Review: https://reviewboard.asterisk.org/r/3834/
........

Merged revisions 419440 from http://svn.asterisk.org/svn/asterisk/branches/1.8


git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/11@419441 65c4cc65-6c06-0410-ace0-fbb531ad65f3
---

diff --git a/channels/chan_sip.c b/channels/chan_sip.c
index 63aaf3532d..d1461abf84 100644
--- a/channels/chan_sip.c
+++ b/channels/chan_sip.c
@@ -6450,9 +6450,9 @@ static void sip_subscribe_mwi_destroy(struct sip_subscription_mwi *mwi)
 {
 	if (mwi->call) {
 		mwi->call->mwi = NULL;
-		sip_destroy(mwi->call);
+		mwi->call = dialog_unref(mwi->call, "sip_subscription_mwi destruction");
 	}
-	
+
 	AST_SCHED_DEL(sched, mwi->resub);
 	ast_string_field_free_memory(mwi);
 	ast_free(mwi);