[asterisk-bugs] [Asterisk 0013700]: peer outboundproxy-ptr is copied to dialog and then freed

[Asterisk Bug Tracker]

A NOTE has been added to this issue. 
====================================================================== 
http://bugs.digium.com/view.php?id=13700 
====================================================================== 
Reported By:                fnordian
Assigned To:                putnopvut
====================================================================== 
Project:                    Asterisk
Issue ID:                   13700
Category:                   Channels/chan_sip/General
Reproducibility:            always
Severity:                   minor
Priority:                   normal
Status:                     assigned
Asterisk Version:           SVN 
SVN Branch (only for SVN checkouts, not tarball releases): 1.6.1 
SVN Revision (number only!): 149483 
Disclaimer on File?:        N/A 
Request Review:              
====================================================================== 
Date Submitted:             2008-10-15 07:51 CDT
Last Modified:              2008-10-15 10:50 CDT
====================================================================== 
Summary:                    peer outboundproxy-ptr is copied to dialog and then
freed
Description: 
Hi,
create_addr() refs a peer (by using find_peer), copies the peer's
outboundproxy ptr to the dialog (create_addr_from_peer -> obproxy_get) and
then unrefs the peer.

While freeing the peer, the outboundproxy gets freed too, so as a result
the ptr in the dialog shows to unallocated memory. This results in
outboundproxy configured by peer not working.
====================================================================== 

---------------------------------------------------------------------- 
 (0093708) putnopvut (administrator) - 2008-10-15 10:50
 http://bugs.digium.com/view.php?id=13700#c93708 
---------------------------------------------------------------------- 
I have uploaded a patch, 13700.patch, which attempts to resolve this
problem. The way it works is to make a peer's outboundproxy a reference
counted object. This way, as long as a sip_pvt references the
outboundproxy, it won't be freed, even if the sip_peer is freed.

Please test this and see if it works correctly for you. 

Issue History 
Date Modified    Username       Field                    Change               
====================================================================== 
2008-10-15 10:50 putnopvut      Note Added: 0093708                          
======================================================================