From aaa44d6ea5179bda77205df923d2286c70102e14 Mon Sep 17 00:00:00 2001 From: Corey Farrell Date: Thu, 24 Jul 2014 17:56:51 +0000 Subject: [PATCH] chan_sip: sip_subscribe_mwi_destroy should not call sip_destroy sip_subscribe_mwi_destroy calls sip_destroy on the reference counted mwi->call. This results in the fields of mwi->call being freed, but mwi->call itself it leaked. If other code is still using mwi->call it can cause problems. This change uses dialog_unref instead, to balance the ref provided by sip_alloc(). ASTERISK-24087 #close Reported by: Corey Farrell Review: https://reviewboard.asterisk.org/r/3834/ ........ Merged revisions 419440 from http://svn.asterisk.org/svn/asterisk/branches/1.8 git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/11@419441 65c4cc65-6c06-0410-ace0-fbb531ad65f3 --- channels/chan_sip.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/channels/chan_sip.c b/channels/chan_sip.c index 63aaf3532d..d1461abf84 100644 --- a/channels/chan_sip.c +++ b/channels/chan_sip.c @@ -6450,9 +6450,9 @@ static void sip_subscribe_mwi_destroy(struct sip_subscription_mwi *mwi) { if (mwi->call) { mwi->call->mwi = NULL; - sip_destroy(mwi->call); + mwi->call = dialog_unref(mwi->call, "sip_subscription_mwi destruction"); } - + AST_SCHED_DEL(sched, mwi->resub); ast_string_field_free_memory(mwi); ast_free(mwi);