From 9e615dac638eb34f1f431aa4294dfeb0195371d8 Mon Sep 17 00:00:00 2001 From: Alexei Gradinari Date: Thu, 5 Jul 2018 17:02:00 -0400 Subject: [PATCH] res_pjsip_pubsub: segfault in function publish_expire The function pubsub_on_rx_publish_request incorrectly uses of AST_SCHED_REPLACE_UNREF. The AST_SCHED_REPLACE_UNREF should unref old '_data'. Because of this, there may be a double unref of variable 'publication' when ast_sched_del is unsuccessful that leads to use after free of the 'publication' in publish_expire. ASTERISK-27956 #close Change-Id: Ie0f0cfc7e036953d890b188656010b325a5cdc82 --- res/res_pjsip_pubsub.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/res/res_pjsip_pubsub.c b/res/res_pjsip_pubsub.c index 257922bccd..2f32ebc4d0 100644 --- a/res/res_pjsip_pubsub.c +++ b/res/res_pjsip_pubsub.c @@ -3424,7 +3424,7 @@ static pj_bool_t pubsub_on_rx_publish_request(pjsip_rx_data *rdata) ao2_link(handler->publications, publication); AST_SCHED_REPLACE_UNREF(publication->sched_id, sched, expires * 1000, publish_expire, publication, - ao2_ref(publication, -1), ao2_ref(publication, -1), ao2_ref(publication, +1)); + ao2_ref(_data, -1), ao2_ref(publication, -1), ao2_ref(publication, +1)); } else { AST_SCHED_DEL_UNREF(sched, publication->sched_id, ao2_ref(publication, -1)); } -- 2.47.2