[Pkg-voip-commits] [pjproject] 03/14: asterisk/0001-r5400-pjsip_tx_data_dec_ref

[Bernhard Schmidt]

This is an automated email from the git hooks/post-receive script.

berni pushed a commit to branch master
in repository pjproject.

commit f633709e02b970bd075939bc1c9b5647fb47f23b
Author: Bernhard Schmidt <berni at debian.org>
Date:   Thu Nov 10 09:45:37 2016 +0100

    asterisk/0001-r5400-pjsip_tx_data_dec_ref
    
    This patch fixes the issue in pjsip_tx_data_dec_ref()
    when tx_data_destroy can be called more than once,
    and checks if invalid value (e.g. NULL) is passed to.
    
    Patch-Category: asterisk
---
 pjsip/src/pjsip/sip_transport.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/pjsip/src/pjsip/sip_transport.c b/pjsip/src/pjsip/sip_transport.c
index 49d8202..f87e47c 100644
--- a/pjsip/src/pjsip/sip_transport.c
+++ b/pjsip/src/pjsip/sip_transport.c
@@ -491,8 +491,13 @@ static void tx_data_destroy(pjsip_tx_data *tdata)
  */
 PJ_DEF(pj_status_t) pjsip_tx_data_dec_ref( pjsip_tx_data *tdata )
 {
-    pj_assert( pj_atomic_get(tdata->ref_cnt) > 0);
-    if (pj_atomic_dec_and_get(tdata->ref_cnt) <= 0) {
+    pj_atomic_value_t ref_cnt;
+    
+    PJ_ASSERT_RETURN(tdata && tdata->ref_cnt, PJ_EINVAL);
+
+    ref_cnt = pj_atomic_dec_and_get(tdata->ref_cnt);
+    pj_assert( ref_cnt >= 0);
+    if (ref_cnt == 0) {
 	tx_data_destroy(tdata);
 	return PJSIP_EBUFDESTROYED;
     } else {

-- 
Alioth's /usr/local/bin/git-commit-notice on /srv/git.debian.org/git/pkg-voip/pjproject.git