kenmirrors/asterisk
1
0
Fork 0
mirror of https://github.com/asterisk/asterisk.git synced 2025-09-06 12:36:58 +00:00
Code Issues Packages Projects Releases Wiki Activity

pjproject_bundled: Add patch for double free issue in timer heap

Browse Source 
Fixed #2172: Avoid double reference counter decrements in
timer in the scenario of race condition between
pj_timer_heap_cancel() and pj_timer_heap_poll().

Change-Id: If000e9438c83ac5084b678eb811e902c035bd2d8
This commit is contained in:
George Joseph
2019-01-22 08:02:37 -07:00
parent 6506c5b1d4
commit 9c11399be3
1 changed files with 42 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

42
third-party/pjproject/patches/0020-Fixed-2172-Avoid-double-reference-counter-decrements.patch vendored Normal file
View File

@@ -0,0 +1,42 @@
From 1fed39fe1488abd654a5488b5e6ad59b4b973331 Mon Sep 17 00:00:00 2001
From: nanang <nanang@localhost>
Date: Tue, 8 Jan 2019 09:07:47 +0000
Subject: [PATCH 1/5] Fixed #2172: Avoid double reference counter decrements in
timer in the scenario of race condition between pj_timer_heap_cancel() and
pj_timer_heap_poll().
---
pjlib/src/pj/timer.c | 17 ++++++++++-------
1 file changed, 10 insertions(+), 7 deletions(-)
diff --git a/pjlib/src/pj/timer.c b/pjlib/src/pj/timer.c
index 90a95e37b..7bae084ef 100644
--- a/pjlib/src/pj/timer.c
+++ b/pjlib/src/pj/timer.c
@@ -580,13 +580,16 @@ static int cancel_timer(pj_timer_heap_t *ht,
lock_timer_heap(ht);
count = cancel(ht, entry, flags | F_DONT_CALL);
- if (flags & F_SET_ID) {
- entry->id = id_val;
- }
- if (entry->_grp_lock) {
- pj_grp_lock_t *grp_lock = entry->_grp_lock;
- entry->_grp_lock = NULL;
- pj_grp_lock_dec_ref(grp_lock);
+ if (count > 0) {
+ /* Timer entry found & cancelled */
+ if (flags & F_SET_ID) {
+ entry->id = id_val;
+ }
+ if (entry->_grp_lock) {
+ pj_grp_lock_t *grp_lock = entry->_grp_lock;
+ entry->_grp_lock = NULL;
+ pj_grp_lock_dec_ref(grp_lock);
+ }
}
unlock_timer_heap(ht);
--
2.20.1