Module: sip-router Branch: 3.1 Commit: 59f7428173b40944f0ba1fbe909254c9ef1ea455 URL: http://git.sip-router.org/cgi-bin/gitweb.cgi/sip-router/?a=commit;h=59f74281...
Author: Daniel-Constantin Mierla miconda@gmail.com Committer: Timo Reimann timo.reimann@1und1.de Date: Fri Mar 4 22:50:02 2011 +0100
dialog: safer unref of terminated dialogs
- if reference counter is already <=0, don't deref anymore, dialog in destroyed state - should protect against bogus dereferencing - reported by Anton Roman (cherry picked from commit 2c28a251a87fd66fa81b4802fe960fef3989fb3d)
---
modules_k/dialog/dlg_hash.c | 19 ++++++++++--------- 1 files changed, 10 insertions(+), 9 deletions(-)
diff --git a/modules_k/dialog/dlg_hash.c b/modules_k/dialog/dlg_hash.c index 0c14f05..95e541c 100644 --- a/modules_k/dialog/dlg_hash.c +++ b/modules_k/dialog/dlg_hash.c @@ -543,11 +543,10 @@ void link_dlg(struct dlg_cell *dlg, int n) */ #define unref_dlg_unsafe(_dlg,_cnt,_d_entry) \ do { \ - (_dlg)->ref -= (_cnt); \ - LM_DBG("unref dlg %p with %d -> %d\n",\ + LM_DBG("unref dlg %p with %d, crt ref count: %d\n",\ (_dlg),(_cnt),(_dlg)->ref);\ - if ((_dlg)->ref<0) {\ - LM_CRIT("bogus ref %d with cnt %d for dlg %p [%u:%u] "\ + if ((_dlg)->ref<=0) {\ + LM_CRIT("bogus op: ref %d with cnt %d for dlg %p [%u:%u] "\ "with clid '%.*s' and tags '%.*s' '%.*s'\n",\ (_dlg)->ref, _cnt, _dlg,\ (_dlg)->h_entry, (_dlg)->h_id,\ @@ -556,11 +555,13 @@ void link_dlg(struct dlg_cell *dlg, int n) (_dlg)->tag[DLG_CALLER_LEG].s,\ (_dlg)->tag[DLG_CALLEE_LEG].len,\ (_dlg)->tag[DLG_CALLEE_LEG].s); \ - }\ - if ((_dlg)->ref<=0) { \ - unlink_unsafe_dlg( _d_entry, _dlg);\ - LM_DBG("ref <=0 for dialog %p\n",_dlg);\ - destroy_dlg(_dlg);\ + } else { \ + (_dlg)->ref -= (_cnt); \ + if ((_dlg)->ref<=0) { \ + unlink_unsafe_dlg( _d_entry, _dlg);\ + LM_DBG("ref <=0 for dialog %p\n",_dlg);\ + destroy_dlg(_dlg);\ + }\ }\ }while(0)
-
Timo Reimann