[asterisk-commits] mmichelson: trunk r381568 - in /trunk: ./ channels/chan_sip.c

[SVN commits to the Asterisk project]

Author: mmichelson
Date: Fri Feb 15 12:51:40 2013
New Revision: 381568

URL: http://svnview.digium.com/svn/asterisk?view=rev&rev=381568
Log:
Fix a crash that occurred when a BYE was received on a replaced dialog.

Reference counting for the channel and its tech_pvt got messed up at
some point between 1.8 and 11. The result was that if a BYE for a dialog
that had been replaced (via an INVITE with Replaces) was received, Asterisk
would crash due to trying to access data on a channel that was no longer there.

The fix I introduced is to remove code that both unrefs the sip_pvt and sets
the channel's tech_pvt to NULL when an INVITE with Replaces is handled. This
way when a BYE is received, the tech_pvt will be non-NULL and so the BYE can
be processed and not cause a crash.

(closes issue ASTERISK-20929)
reported by Kristopher Lalletti
patches:
	ASTERISK-20929.patch uploaded by Mark Michelson (License #5049)
........

Merged revisions 381566 from http://svn.asterisk.org/svn/asterisk/branches/11

Modified:
    trunk/   (props changed)
    trunk/channels/chan_sip.c

Propchange: trunk/
------------------------------------------------------------------------------
Binary property 'branch-11-merged' - no diff available.

Modified: trunk/channels/chan_sip.c
URL: http://svnview.digium.com/svn/asterisk/trunk/channels/chan_sip.c?view=diff&rev=381568&r1=381567&r2=381568
==============================================================================
--- trunk/channels/chan_sip.c (original)
+++ trunk/channels/chan_sip.c Fri Feb 15 12:51:40 2013
@@ -24815,9 +24815,6 @@
 	ast_setstate(c, AST_STATE_DOWN);
 	ast_channel_unlock(c);
 
-	/* The call should be down with no ast_channel, so hang it up */
-	ast_channel_tech_pvt_set(c, dialog_unref(ast_channel_tech_pvt(c), "unref dialog c->tech_pvt"));
-
 	/* c and c's tech pvt must be unlocked at this point for ast_hangup */
 	ast_hangup(c);
 	/* this indicates to handle_request_do that the owner channel has already been unlocked */