libs/pjproject/patches/0011-sip_inv_patch.patch

   1 commit c3c1bf45cae2a35003aa16c267d59f97027f9c5e
   2 Author: Kevin Harwell <kharwell@digium.com>
   3 Date:   Thu Jun 11 11:11:13 2020 -0500
   4
   5     sip_inv - fix invite session ref count crash
   6
   7     Ensure the session's ref count is only decremented under proper conditons.
   8
   9     For more details see the following issue report:
  10     https://github.com/pjsip/pjproject/issues/2443
  11
  12     Patch supplied by sauwming
  13
  14 --- a/pjsip/src/pjsip-ua/sip_inv.c
  15 +++ b/pjsip/src/pjsip-ua/sip_inv.c
  16 @@ -323,9 +323,19 @@ static void inv_set_state(pjsip_inv_sess
  17         (*mod_inv.cb.on_state_changed)(inv, e);
  18      pjsip_inv_dec_ref(inv);
  19
  20 -    /* Only decrement when previous state is not already DISCONNECTED */
  21 +    /* The above callback may change the state, so we need to be careful here
  22 +     * and only decrement inv under the following conditions:
  23 +     * 1. If the state parameter is DISCONNECTED, and previous state is not
  24 +     *    already DISCONNECTED.
  25 +     *    This is to make sure that dec_ref() is not called more than once.
  26 +     * 2. If current state is PJSIP_INV_STATE_DISCONNECTED.
  27 +     *    This is to make sure that dec_ref() is not called if user restarts
  28 +     *    inv within the callback. Note that this check must be last since
  29 +     *    inv may have already been destroyed.
  30 +     */
  31      if (state == PJSIP_INV_STATE_DISCONNECTED &&
  32 -       prev_state != PJSIP_INV_STATE_DISCONNECTED)
  33 +       prev_state != PJSIP_INV_STATE_DISCONNECTED &&
  34 +       inv->state == PJSIP_INV_STATE_DISCONNECTED)
  35      {
  36         pjsip_inv_dec_ref(inv);
  37      }