From: Joshua Colp <jcolp@digium.com>
Date: Tue, 23 Aug 2016 11:31:05 +0000 (+0000)
Subject: chan_sip: Don't allocate new RTP instances on top of old ones.
X-Git-Tag: certified/11.6-cert15~5
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=c7cb8f7808718d3e275a7114ebe5939020618879;p=thirdparty%2Fasterisk.git

chan_sip: Don't allocate new RTP instances on top of old ones.

In some scenarios dialog_initialize_rtp can be called multiple times on
the same dialog.  This can cause RTP instances to be leaked along with
multiple file descriptors for each instance.

This change makes it so the existing RTP instances are destroyed and
not overwritten, stopping the memory leak.

ASTERISK-26272 #close
patches:
  ASTERISK-26272-11.patch submitted by Corey Farrell (license 5909)

Change-Id: I3c1d94dea8594fe0702168cb979b898ae0f5fc5d
---

diff --git a/channels/chan_sip.c b/channels/chan_sip.c
index 8e1a724a7a..c99ea5db70 100644
--- a/channels/chan_sip.c
+++ b/channels/chan_sip.c
@@ -5708,6 +5708,38 @@ static void copy_socket_data(struct sip_socket *to_sock, const struct sip_socket
 	*to_sock = *from_sock;
 }
 
+/*! Cleanup the RTP and SRTP portions of a dialog
+ *
+ * \note This procedure excludes vsrtp as it is initialized differently.
+ */
+static void dialog_clean_rtp(struct sip_pvt *p)
+{
+	if (p->rtp) {
+		ast_rtp_instance_destroy(p->rtp);
+		p->rtp = NULL;
+	}
+
+	if (p->vrtp) {
+		ast_rtp_instance_destroy(p->vrtp);
+		p->vrtp = NULL;
+	}
+
+	if (p->trtp) {
+		ast_rtp_instance_destroy(p->trtp);
+		p->trtp = NULL;
+	}
+
+	if (p->srtp) {
+		sip_srtp_destroy(p->srtp);
+		p->srtp = NULL;
+	}
+
+	if (p->tsrtp) {
+		sip_srtp_destroy(p->tsrtp);
+		p->tsrtp = NULL;
+	}
+}
+
 /*! \brief Initialize DTLS-SRTP support on an RTP instance */
 static int dialog_initialize_dtls_srtp(const struct sip_pvt *dialog, struct ast_rtp_instance *rtp, struct sip_srtp **srtp)
 {
@@ -5755,6 +5787,9 @@ static int dialog_initialize_rtp(struct sip_pvt *dialog)
 		return 0;
 	}
 
+	/* Make sure previous RTP instances/FD's do not leak */
+	dialog_clean_rtp(dialog);
+
 	ast_sockaddr_copy(&bindaddr_tmp, &bindaddr);
 	if (!(dialog->rtp = ast_rtp_instance_new(dialog->engine, sched, &bindaddr_tmp, NULL))) {
 		return -1;
@@ -6414,18 +6449,10 @@ void __sip_destroy(struct sip_pvt *p, int lockowner, int lockdialoglist)
 		ast_free(p->notify);
 		p->notify = NULL;
 	}
-	if (p->rtp) {
-		ast_rtp_instance_destroy(p->rtp);
-		p->rtp = NULL;
-	}
-	if (p->vrtp) {
-		ast_rtp_instance_destroy(p->vrtp);
-		p->vrtp = NULL;
-	}
-	if (p->trtp) {
-		ast_rtp_instance_destroy(p->trtp);
-		p->trtp = NULL;
-	}
+
+	/* Free RTP and SRTP instances */
+	dialog_clean_rtp(p);
+
 	if (p->udptl) {
 		ast_udptl_destroy(p->udptl);
 		p->udptl = NULL;
@@ -6468,21 +6495,11 @@ void __sip_destroy(struct sip_pvt *p, int lockowner, int lockdialoglist)
 
 	destroy_msg_headers(p);
 
-	if (p->srtp) {
-		sip_srtp_destroy(p->srtp);
-		p->srtp = NULL;
-	}
-
 	if (p->vsrtp) {
 		sip_srtp_destroy(p->vsrtp);
 		p->vsrtp = NULL;
 	}
 
-	if (p->tsrtp) {
-		sip_srtp_destroy(p->tsrtp);
-		p->tsrtp = NULL;
-	}
-
 	if (p->directmediaacl) {
 		p->directmediaacl = ast_free_acl_list(p->directmediaacl);
 	}