[asterisk-bugs] [JIRA] (ASTERISK-28286) chan_sip - no lock pvt data in proc_session_timer()

[Chris Savinovich (JIRA)]

    [ https://issues.asterisk.org/jira/browse/ASTERISK-28286?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=246248#comment-246248 ] 

Chris Savinovich commented on ASTERISK-28286:
---------------------------------------------

Hello Krzysztof,
Starting with versions 13.x, Asterisk is in the process of solely supporting chan_pjsip for SIP calls and allowing chan_sip to be solely supported  by the community. You would be more than welcome to submit any patches to chan_sip using our Gerrit site that you estimate can fix this issue.

Thanks




> chan_sip - no lock pvt data in proc_session_timer()
> ---------------------------------------------------
>
>                 Key: ASTERISK-28286
>                 URL: https://issues.asterisk.org/jira/browse/ASTERISK-28286
>             Project: Asterisk
>          Issue Type: Bug
>      Security Level: None
>          Components: Channels/chan_sip/General
>    Affects Versions: 13.24.1
>         Environment: Ubuntu 12.04
>            Reporter: Krzysztof Trempala
>
> I have a problem with accidentally overwriting the heap in the situation:
>  - process session refresh timeout in function proc_session_timer() run transmit_reinvite_with_sdp()
>  - call has been terminated and channel is destroying 
> {noformat} 
> +====================================+
> |         sched thread               |
> +====================================+
>  ..
>  proc_session_timer()
>   transmit_reinvite_with_sdp (p, ..)
>    try_suggested_sip_codec(p,..)              +=========================+
>     pbx_builtin_getvar_helper(chan=p->owner)  |   channel thread        |
>                                               +=========================+
>                                               | ...	                    |
>             <---------------------------------| sip_hangup              |
>                                               |  sip_set_owner(p, NULL);|
>                                               |   p->owner = NULL;      |
>                                               | ...                     |
>                                               | channel destroy         |
>      ast_channel_lock(chan);                  +-------------------------+
> {noformat} 



--
This message was sent by Atlassian JIRA
(v6.2#6252)