[asterisk-commits] kharwell: trunk r406848 - in /trunk: ./ res/res_pjsip_pubsub.c

[SVN commits to the Asterisk project]

Author: kharwell
Date: Tue Jan 28 17:40:28 2014
New Revision: 406848

URL: http://svnview.digium.com/svn/asterisk?view=rev&rev=406848
Log:
res_pjsip_pubsub: potential crash on timeout

What seems to be happening is if a subscription has been terminated and the
subscription timeout/expires is less than the time it takes for all pending
transactions (currently on the subscription) to end then the subscription
timer will not have been canceled yet and sub will be null.  Since the
subscription has already been canceled nothing needs to be done so a null
check in the asterisk code is sufficient in working around this problem.

(closes issue ASTERISK-23129)
Reported by: Dan Jenkins
........

Merged revisions 406847 from http://svn.asterisk.org/svn/asterisk/branches/12

Modified:
    trunk/   (props changed)
    trunk/res/res_pjsip_pubsub.c

Propchange: trunk/
------------------------------------------------------------------------------
Binary property 'branch-12-merged' - no diff available.

Modified: trunk/res/res_pjsip_pubsub.c
URL: http://svnview.digium.com/svn/asterisk/trunk/res/res_pjsip_pubsub.c?view=diff&rev=406848&r1=406847&r2=406848
==============================================================================
--- trunk/res/res_pjsip_pubsub.c (original)
+++ trunk/res/res_pjsip_pubsub.c Tue Jan 28 17:40:28 2014
@@ -1234,6 +1234,15 @@
 {
 	struct ast_sip_subscription *sub = pjsip_evsub_get_mod_data(evsub, pubsub_module.id);
 
+	if (!sub) {
+		/* if a subscription has been terminated and the subscription
+		   timeout/expires is less than the time it takes for all pending
+		   transactions to end then the subscription timer will not have
+		   been canceled yet and sub will be null, so do nothing since
+		   the subscription has already been terminated. */
+		return;
+	}
+
 	ao2_ref(sub, +1);
 	ast_sip_push_task(sub->serializer, serialized_pubsub_on_server_timeout, sub);
 }