[asterisk-bugs] [JIRA] (ASTERISK-29098) pjsip: Crash in pjnath on cache timeout

[Sean Bright (JIRA)]

    [ https://issues.asterisk.org/jira/browse/ASTERISK-29098?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=252275#comment-252275 ] 

Sean Bright edited comment on ASTERISK-29098 at 9/29/20 7:43 PM:
-----------------------------------------------------------------

I see one patch in the Github issue . Can it work well with the bug?


was (Author: zmxzmxzmxzmx):
I see one patch in the Github issue . Can it work well with the bug?



diff --git a/pjnath/src/pjnath/stun_session.c b/pjnath/src/pjnath/stun_session.c
index f2b4f7058..9687d1f24 100644
--- a/pjnath/src/pjnath/stun_session.c
+++ b/pjnath/src/pjnath/stun_session.c
@@ -228,7 +228,7 @@ PJ_DEF(void) pj_stun_msg_destroy_tdata( pj_stun_session *sess,
 static void on_cache_timeout(pj_timer_heap_t *timer_heap,
 			     struct pj_timer_entry *entry)
 {
-    pj_stun_tx_data *tdata;
+    pj_stun_tx_data *t, *tdata;
     pj_stun_session *sess;
 
     PJ_UNUSED_ARG(timer_heap);
@@ -243,9 +243,19 @@ static void on_cache_timeout(pj_timer_heap_t *timer_heap,
 	return;
     }
 
-    PJ_LOG(5,(SNAME(tdata->sess), "Response cache deleted"));
+    /* Only destroy tdata if it's in the response cache list,
+     * in case of race condition with destroy_tdata().
+     */
+    t = sess->cached_response_list.next;
+    while (t != &sess->cached_response_list) {
+    	if (t == tdata) {
+    	    PJ_LOG(5,(SNAME(tdata->sess), "Response cache deleted"));
+    	    destroy_tdata(tdata, PJ_FALSE);
+    	    break;
+	}
+	t = t->next;
+    }
 
-    destroy_tdata(tdata, PJ_FALSE);
     pj_grp_lock_release(sess->grp_lock);
 
 }

> pjsip: Crash in pjnath on cache timeout
> ---------------------------------------
>
>                 Key: ASTERISK-29098
>                 URL: https://issues.asterisk.org/jira/browse/ASTERISK-29098
>             Project: Asterisk
>          Issue Type: Bug
>      Security Level: None
>          Components: pjproject/pjsip
>    Affects Versions: 17.6.0, 17.8.0
>         Environment: centos 6.10
>            Reporter: 钟明星
>            Assignee: Unassigned
>              Labels: webrtc
>         Attachments: bt.txt, core.alast1-2020-09-26T15-00-47+0800-brief.txt, core.alast1-2020-09-26T15-00-47+0800-full.txt, core.alast1-2020-09-26T15-00-47+0800-info.txt, core.alast1-2020-09-26T15-00-47+0800-locks.txt, core.alast1-2020-09-26T15-00-47+0800-thread1.txt
>
>
> asterisk Frequency crash
> according to https://wiki.asterisk.org/wiki/display/AST/Getting+a+Backtrace



--
This message was sent by Atlassian JIRA
(v6.2#6252)