From: Damien Wedhorn <voip@facts.com.au>
Date: Sun, 20 Jan 2013 02:53:29 +0000 (+0000)
Subject: Fix issues with skinny sessions
X-Git-Tag: 11.3.0-rc1~3^2~24
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=cb5f7233b91e9464bd1cd29db78db03a38511bba;p=thirdparty%2Fasterisk.git

Fix issues with skinny sessions

Fixes a couple of issues with the way skinny handles sessions by ensuring
sessions aren't used after being freed. Some other minor changes.

Review: https://reviewboard.asterisk.org/r/2272/


git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/11@379582 65c4cc65-6c06-0410-ace0-fbb531ad65f3
---

diff --git a/channels/chan_skinny.c b/channels/chan_skinny.c
index ea213e9e9c..fd67706bae 100644
--- a/channels/chan_skinny.c
+++ b/channels/chan_skinny.c
@@ -6820,15 +6820,21 @@ static void destroy_session(struct skinnysession *s)
 	AST_LIST_TRAVERSE_SAFE_BEGIN(&sessions, cur, list) {
 		if (cur == s) {
 			AST_LIST_REMOVE_CURRENT(list);
-			if (s->fd > -1) 
+			if (s->fd > -1) {
 				close(s->fd);
-			
-			if (!s->device)
+			}
+
+			if (s->device) {
+				s->device->session = NULL;
+			} else {
 				ast_atomic_fetchadd_int(&unauth_sessions, -1);
+			}
 
 			ast_mutex_destroy(&s->lock);
-			
+
 			ast_free(s);
+
+			break;
 		}
 	}
 	AST_LIST_TRAVERSE_SAFE_END
@@ -6966,21 +6972,22 @@ static void *skinny_session(void *data)
 		res = get_input(s);
 		if (res < 0) {
 			ast_verb(3, "Ending Skinny session from %s (bad input)\n", ast_inet_ntoa(s->sin.sin_addr));
-			break;
+			destroy_session(s);
+			return NULL;
 		}
 
 		if (res > 0)
 		{
 			if (!(req = skinny_req_parse(s))) {
-				destroy_session(s);
 				ast_verb(3, "Ending Skinny session from %s (failed parse)\n", ast_inet_ntoa(s->sin.sin_addr));
+				destroy_session(s);
 				return NULL;
 			}
 
 			res = handle_message(req, s);
 			if (res < 0) {
-				destroy_session(s);
 				ast_verb(3, "Ending Skinny session from %s\n", ast_inet_ntoa(s->sin.sin_addr));
+				destroy_session(s);
 				return NULL;
 			}
 		}