[asterisk-commits] mnicholson: branch 1.4 r294163 - /branches/1.4/channels/chan_sip.c

[SVN commits to the Asterisk project]

Author: mnicholson
Date: Mon Nov  8 12:59:20 2010
New Revision: 294163

URL: http://svnview.digium.com/svn/asterisk?view=rev&rev=294163
Log:
Modify our handling of 491 responses to drop any pending reinvite retry scheduler entries if we get a new 491.

This prevents a scheduler entry from leaking if we receive a 491 response when one is pending.  If a scheduler entry leaks, the pvt it is associated my get destroyed before the scheduler entry fires, and then memory corruption and crashes can occur when the scheduled reinvite attempts to access and modify the memory of the destroyed pvt.

ABE-2543

Modified:
    branches/1.4/channels/chan_sip.c

Modified: branches/1.4/channels/chan_sip.c
URL: http://svnview.digium.com/svn/asterisk/branches/1.4/channels/chan_sip.c?view=diff&rev=294163&r1=294162&r2=294163
==============================================================================
--- branches/1.4/channels/chan_sip.c (original)
+++ branches/1.4/channels/chan_sip.c Mon Nov  8 12:59:20 2010
@@ -13497,6 +13497,14 @@
 				} else {
 					wait = ast_random() % 2000;
 				}
+
+				if (p->waitid != -1) {
+					if (option_debug > 2)
+						ast_log(LOG_DEBUG, "Reinvite race during existing reinvite race. Abandoning previous reinvite retry.\n");
+					AST_SCHED_DEL(sched, p->waitid);
+					p->waitid = -1;
+				}
+
 				p->waitid = ast_sched_add(sched, wait, sip_reinvite_retry, p);
 				if (option_debug > 2)
 					ast_log(LOG_DEBUG, "Reinvite race. Waiting %d secs before retry\n", wait);