[asterisk-commits] res stasis device state: Fix refcounting error. (asterisk[master])

[SVN commits to the Asterisk project]

Joshua Colp has submitted this change and it was merged.

Change subject: res_stasis_device_state: Fix refcounting error.
......................................................................


res_stasis_device_state: Fix refcounting error.

Device state subscription lifetimes were governed by when the
subscription was established and unsubscribed from. However, it is
possible that at the time of unsubscription, there could be device state
events still in flight. When those device state events occur, the device
state callback could attempt to dereference a freed pointer. Crash.

This change ensures that the lifetime of the device state subscription
does not end until the underlying stasis subscription has confirmed that
its final message has been sent.

Change-Id: I25a0f1472894c1a562252fb7129671478e25e9b2
---
M res/res_stasis_device_state.c
1 file changed, 9 insertions(+), 1 deletion(-)

Approvals:
  Anonymous Coward #1000019: Verified
  Joshua Colp: Looks good to me, approved
  George Joseph: Looks good to me, but someone else must approve



diff --git a/res/res_stasis_device_state.c b/res/res_stasis_device_state.c
index 4093646..453bfae 100644
--- a/res/res_stasis_device_state.c
+++ b/res/res_stasis_device_state.c
@@ -303,6 +303,12 @@
 {
 	struct ast_device_state_message *device_state;
 
+	if (stasis_subscription_final_message(sub, msg)) {
+		/* Remove stasis subscription's reference to device_state_subscription */
+		ao2_ref(data, -1);
+		return;
+	}
+
 	if (ast_device_state_message_type() != stasis_message_type(msg)) {
 		return;
 	}
@@ -365,10 +371,12 @@
 
 	ast_debug(3, "Subscribing to device %s\n", sub->device_name);
 
-	sub->sub = stasis_subscribe_pool(topic, device_state_cb, sub);
+	sub->sub = stasis_subscribe_pool(topic, device_state_cb, ao2_bump(sub));
 	if (!sub->sub) {
 		ast_log(LOG_ERROR, "Unable to subscribe to device %s\n",
 			sub->device_name);
+		/* Reference we added when attempting to stasis_subscribe_pool */
+		ao2_ref(sub, -1);
 		return -1;
 	}
 

-- 
To view, visit https://gerrit.asterisk.org/2196
To unsubscribe, visit https://gerrit.asterisk.org/settings

Gerrit-MessageType: merged
Gerrit-Change-Id: I25a0f1472894c1a562252fb7129671478e25e9b2
Gerrit-PatchSet: 1
Gerrit-Project: asterisk
Gerrit-Branch: master
Gerrit-Owner: Mark Michelson <mmichelson at digium.com>
Gerrit-Reviewer: Anonymous Coward #1000019
Gerrit-Reviewer: George Joseph <george.joseph at fairview5.com>
Gerrit-Reviewer: Joshua Colp <jcolp at digium.com>