From dfbb03cc8e1d284b50805be8dfd6eb5595172143 Mon Sep 17 00:00:00 2001 From: Kevin Harwell Date: Tue, 3 May 2016 15:31:19 -0500 Subject: [PATCH] res_pjsip_outbound_publish: Potential crash due to off nominal path It was possible for the explicit publish destroy function to be called without the pjsip client ever being initialized. This fix checks to make sure there is a client to destroy before attempting. Change-Id: I8eea1bfa3bd472149bfc255310be2a6248688f5c --- res/res_pjsip_outbound_publish.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/res/res_pjsip_outbound_publish.c b/res/res_pjsip_outbound_publish.c index 0265c424e3..ed06a33d1a 100644 --- a/res/res_pjsip_outbound_publish.c +++ b/res/res_pjsip_outbound_publish.c @@ -701,8 +701,15 @@ static int explicit_publish_destroy(void *data) { struct ast_sip_outbound_publish_client *client = data; - pjsip_publishc_destroy(client->client); - ao2_ref(client, -1); + /* + * If there is no pjsip publishing client then we obviously don't need + * to destroy it. Also, the ref for the Asterisk publishing client that + * pjsip had would not exist or should already be gone as well. + */ + if (client->client) { + pjsip_publishc_destroy(client->client); + ao2_ref(client, -1); + } return 0; } -- 2.47.2