[Asterisk-code-review] res pjsip transport websocket: Fix use-after-free bugs. (asterisk[master])

[Ivan Poddubny]

Ivan Poddubny has posted comments on this change.

Change subject: res_pjsip_transport_websocket: Fix use-after-free bugs.
......................................................................


Patch Set 5:

(3 comments)

https://gerrit.asterisk.org/#/c/598/5/res/res_pjsip_transport_websocket.c
File res/res_pjsip_transport_websocket.c:

Line 123: 	ao2_ref(wstransport, -1);
> I don't think this should be dropped here, as it took me looking at the ent
That's exactly what I did first, but it didn't work because the destructor tried to call pj functions from a non-pj thead, and it failed. That's why I had to move it here.


Line 192: 	pjsip_transport_register(newtransport->transport.tpmgr, (pjsip_transport *)newtransport);
> This currently steals the initial reference to newtransport, which makes re
Done


Line 314: 	ao2_ref(transport, +1);
> Don't do a ref here (which was needed as before you stole it) - instead use
Done


-- 
To view, visit https://gerrit.asterisk.org/598
To unsubscribe, visit https://gerrit.asterisk.org/settings

Gerrit-MessageType: comment
Gerrit-Change-Id: Idc0b63eb6e459c1ddfb2430127d34b3c4d8d373b
Gerrit-PatchSet: 5
Gerrit-Project: asterisk
Gerrit-Branch: master
Gerrit-Owner: Ivan Poddubny <ivan.poddubny at gmail.com>
Gerrit-Reviewer: Ivan Poddubny <ivan.poddubny at gmail.com>
Gerrit-Reviewer: Joshua Colp <jcolp at digium.com>
Gerrit-HasComments: Yes