[Asterisk-code-review] res pjsip transport websocket: Fix use-after-free bugs. (asterisk[master])

[Joshua Colp]

Joshua Colp has posted comments on this change.

Change subject: res_pjsip_transport_websocket: Fix use-after-free bugs.
......................................................................


Patch Set 3: Code-Review-1

(5 comments)

https://gerrit.asterisk.org/#/c/598/3/res/res_pjsip_transport_websocket.c
File res/res_pjsip_transport_websocket.c:

Line 94: 	struct ws_transport *wstransport = (struct ws_transport*)arg;
You don't need to do the (struct ws_transport*) cast here.


Line 98: 		wstransport->ws_session = NULL;
Setting the various parts of this structure to NULL won't really accomplish anything, when the destructor is called this memory is getting freed immediately after.


Line 117: 		pj_pool_t *pool;
        : 
        : 		pool = wstransport->transport.pool;
        : 		wstransport->transport.pool = NULL;
Like I said above you don't need to set this to NULL and can just call pjsip_endpt_release_pool


Line 161: 	newtransport = ao2_t_alloc(sizeof(*newtransport), transport_dtor,
This allocates a lock with the transport that isn't used. You can use ao2_t_alloc_options with AO2_ALLOC_OPT_LOCK_NOLOCK as an option to allocate without a lock.


Line 207: 		ao2_cleanup(newtransport);
It's guaranteed newtransport will be non-NULL so ao2_ref can be used instead.


-- 
To view, visit https://gerrit.asterisk.org/598
To unsubscribe, visit https://gerrit.asterisk.org/settings

Gerrit-MessageType: comment
Gerrit-Change-Id: Idc0b63eb6e459c1ddfb2430127d34b3c4d8d373b
Gerrit-PatchSet: 3
Gerrit-Project: asterisk
Gerrit-Branch: master
Gerrit-Owner: Ivan Poddubny <ivan.poddubny at gmail.com>
Gerrit-Reviewer: Ivan Poddubny <ivan.poddubny at gmail.com>
Gerrit-Reviewer: Joshua Colp <jcolp at digium.com>
Gerrit-HasComments: Yes