<p>Richard Mudgett has uploaded this change for <strong>review</strong>.</p><p><a href="https://gerrit.asterisk.org/8698">View Change</a></p><pre style="font-family: monospace,monospace; white-space: pre-wrap;">pjsip_transport_events.c: Fix crash using stale transport pointer.<br><br>Apparently it is possible for the transport to be destroyed without<br>triggering the transport callback logic.  As a result the transport gets<br>destroyed and we have a stale pointer in the active_transports container.<br><br>* Invoke the transport monitor callback checks when the transport is<br>destroyed in addition to when it is disconnected and shutdown.<br><br>ASTERISK-27688<br><br>Change-Id: Ia9b5469fea8f2b3f2d8476fae6b748a4d23e7261<br>---<br>M res/res_pjsip/pjsip_transport_events.c<br>1 file changed, 40 insertions(+), 15 deletions(-)<br><br></pre><pre style="font-family: monospace,monospace; white-space: pre-wrap;">git pull ssh://gerrit.asterisk.org:29418/asterisk refs/changes/98/8698/1</pre><pre style="font-family: monospace,monospace; white-space: pre-wrap;">diff --git a/res/res_pjsip/pjsip_transport_events.c b/res/res_pjsip/pjsip_transport_events.c<br>index c701b84..cc7b7c0 100644<br>--- a/res/res_pjsip/pjsip_transport_events.c<br>+++ b/res/res_pjsip/pjsip_transport_events.c<br>@@ -114,6 +114,36 @@<br>  AST_VECTOR_FREE(&monitored->monitors);<br> }<br> <br>+/*!<br>+ * \internal<br>+ * \brief Do registered callbacks for the transport.<br>+ * \since 13.21.0<br>+ *<br>+ * \param transports Active transports container<br>+ * \param transport Which transport to do callbacks for.<br>+ *<br>+ * \return Nothing<br>+ */<br>+static void transport_state_do_reg_callbacks(struct ao2_container *transports, pjsip_transport *transport)<br>+{<br>+     struct transport_monitor *monitored;<br>+<br>+      monitored = ao2_find(transports, transport->obj_name, OBJ_SEARCH_KEY | OBJ_UNLINK);<br>+       if (monitored) {<br>+             int idx;<br>+<br>+          for (idx = AST_VECTOR_SIZE(&monitored->monitors); idx--;) {<br>+                   struct transport_monitor_notifier *notifier;<br>+<br>+                      notifier = AST_VECTOR_GET_ADDR(&monitored->monitors, idx);<br>+                    ast_debug(3, "running callback %p(%p) for transport %s\n",<br>+                         notifier->cb, notifier->data, transport->obj_name);<br>+                 notifier->cb(notifier->data);<br>+          }<br>+            ao2_ref(monitored, -1);<br>+      }<br>+}<br>+<br> /*! \brief Callback invoked when transport state changes occur */<br> static void transport_state_callback(pjsip_transport *transport,<br>       pjsip_transport_state state, const pjsip_transport_state_info *info)<br>@@ -147,6 +177,7 @@<br>                     if (!transport->is_shutdown) {<br>                             pjsip_transport_shutdown(transport);<br>                  }<br>+                    transport_state_do_reg_callbacks(transports, transport);<br>                      break;<br>                case PJSIP_TP_STATE_SHUTDOWN:<br>                         /*<br>@@ -157,23 +188,17 @@<br>                      */<br>                   transport->is_shutdown = PJ_TRUE;<br> <br>-                      monitored = ao2_find(transports, transport->obj_name,<br>-                             OBJ_SEARCH_KEY | OBJ_UNLINK);<br>-                        if (monitored) {<br>-                             int idx;<br>-<br>-                          for (idx = AST_VECTOR_SIZE(&monitored->monitors); idx--;) {<br>-                                   struct transport_monitor_notifier *notifier;<br>-<br>-                                      notifier = AST_VECTOR_GET_ADDR(&monitored->monitors, idx);<br>-                                    ast_debug(3, "running callback %p(%p) for transport %s\n",<br>-                                         notifier->cb, notifier->data, transport->obj_name);<br>-                                 notifier->cb(notifier->data);<br>-                          }<br>-                            ao2_ref(monitored, -1);<br>-                      }<br>+                    transport_state_do_reg_callbacks(transports, transport);<br>+                     break;<br>+               case PJSIP_TP_STATE_DESTROY:<br>+                 transport_state_do_reg_callbacks(transports, transport);<br>                      break;<br>                default:<br>+                     /*<br>+                    * We have to have a default case because the enum is<br>+                         * defined by a third-party library.<br>+                  */<br>+                  ast_assert(0);<br>                        break;<br>                }<br> <br></pre><p>To view, visit <a href="https://gerrit.asterisk.org/8698">change 8698</a>. To unsubscribe, visit <a href="https://gerrit.asterisk.org/settings">settings</a>.</p><div itemscope itemtype="http://schema.org/EmailMessage"><div itemscope itemprop="action" itemtype="http://schema.org/ViewAction"><link itemprop="url" href="https://gerrit.asterisk.org/8698"/><meta itemprop="name" content="View Change"/></div></div>

<div style="display:none"> Gerrit-Project: asterisk </div>
<div style="display:none"> Gerrit-Branch: 15 </div>
<div style="display:none"> Gerrit-MessageType: newchange </div>
<div style="display:none"> Gerrit-Change-Id: Ia9b5469fea8f2b3f2d8476fae6b748a4d23e7261 </div>
<div style="display:none"> Gerrit-Change-Number: 8698 </div>
<div style="display:none"> Gerrit-PatchSet: 1 </div>
<div style="display:none"> Gerrit-Owner: Richard Mudgett <rmudgett@digium.com> </div>
<div style="display:none"> Gerrit-Reviewer: Ross Beer <ross.beer@voicehost.co.uk> </div>