[sr-dev] git:3.1: dialog: safer unref of terminated dialogs

Timo Reimann timo.reimann at 1und1.de
Fri May 13 17:50:26 CEST 2011


Module: sip-router
Branch: 3.1
Commit: 59f7428173b40944f0ba1fbe909254c9ef1ea455
URL:    http://git.sip-router.org/cgi-bin/gitweb.cgi/sip-router/?a=commit;h=59f7428173b40944f0ba1fbe909254c9ef1ea455

Author: Daniel-Constantin Mierla <miconda at gmail.com>
Committer: Timo Reimann <timo.reimann at 1und1.de>
Date:   Fri Mar  4 22:50:02 2011 +0100

dialog: safer unref of terminated dialogs

- if reference counter is already <=0, don't deref anymore, dialog in
  destroyed state
- should protect against bogus dereferencing
- reported by Anton Roman
(cherry picked from commit 2c28a251a87fd66fa81b4802fe960fef3989fb3d)

---

 modules_k/dialog/dlg_hash.c |   19 ++++++++++---------
 1 files changed, 10 insertions(+), 9 deletions(-)

diff --git a/modules_k/dialog/dlg_hash.c b/modules_k/dialog/dlg_hash.c
index 0c14f05..95e541c 100644
--- a/modules_k/dialog/dlg_hash.c
+++ b/modules_k/dialog/dlg_hash.c
@@ -543,11 +543,10 @@ void link_dlg(struct dlg_cell *dlg, int n)
  */
 #define unref_dlg_unsafe(_dlg,_cnt,_d_entry)   \
 	do { \
-		(_dlg)->ref -= (_cnt); \
-		LM_DBG("unref dlg %p with %d -> %d\n",\
+		LM_DBG("unref dlg %p with %d, crt ref count: %d\n",\
 			(_dlg),(_cnt),(_dlg)->ref);\
-		if ((_dlg)->ref<0) {\
-			LM_CRIT("bogus ref %d with cnt %d for dlg %p [%u:%u] "\
+		if ((_dlg)->ref<=0) {\
+			LM_CRIT("bogus op: ref %d with cnt %d for dlg %p [%u:%u] "\
 				"with clid '%.*s' and tags '%.*s' '%.*s'\n",\
 				(_dlg)->ref, _cnt, _dlg,\
 				(_dlg)->h_entry, (_dlg)->h_id,\
@@ -556,11 +555,13 @@ void link_dlg(struct dlg_cell *dlg, int n)
 				(_dlg)->tag[DLG_CALLER_LEG].s,\
 				(_dlg)->tag[DLG_CALLEE_LEG].len,\
 				(_dlg)->tag[DLG_CALLEE_LEG].s); \
-		}\
-		if ((_dlg)->ref<=0) { \
-			unlink_unsafe_dlg( _d_entry, _dlg);\
-			LM_DBG("ref <=0 for dialog %p\n",_dlg);\
-			destroy_dlg(_dlg);\
+		} else { \
+			(_dlg)->ref -= (_cnt); \
+			if ((_dlg)->ref<=0) { \
+				unlink_unsafe_dlg( _d_entry, _dlg);\
+				LM_DBG("ref <=0 for dialog %p\n",_dlg);\
+				destroy_dlg(_dlg);\
+			}\
 		}\
 	}while(0)
 




More information about the sr-dev mailing list