res_pjsip: Correct usages of pjproject's timer heap

Fix some timer heap initializations and cancels to try and prevent
crashes and timer heap issues.

Change-Id: I64885d190fa22097d1b55987091375541e57a7ee

res/res_pjsip_outbound_publish.c

@@ -362,7 +362,8 @@ static struct ast_sip_event_publisher_handler *find_publisher_handler_for_event_
 /*! \brief Helper function which cancels the refresh timer on a publisher */
 static void cancel_publish_refresh(struct sip_outbound_publisher *publisher)
 {
-	if (pj_timer_heap_cancel(pjsip_endpt_get_timer_heap(ast_sip_get_pjsip_endpoint()), &publisher->timer)) {
+	if (pj_timer_heap_cancel_if_active(pjsip_endpt_get_timer_heap(ast_sip_get_pjsip_endpoint()),
+		&publisher->timer, 0)) {
 		/* The timer was successfully cancelled, drop the refcount of the publisher */
 		ao2_ref(publisher, -1);
 	}

res/res_pjsip_outbound_registration.c

@@ -512,7 +512,8 @@ static struct ast_sip_endpoint_identifier line_identifier = {
 /*! \brief Helper function which cancels the timer on a client */
 static void cancel_registration(struct sip_outbound_registration_client_state *client_state)
 {
-	if (pj_timer_heap_cancel(pjsip_endpt_get_timer_heap(ast_sip_get_pjsip_endpoint()), &client_state->timer)) {
+	if (pj_timer_heap_cancel_if_active(pjsip_endpt_get_timer_heap(ast_sip_get_pjsip_endpoint()),
+		&client_state->timer, client_state->timer.id)) {
 		/* The timer was successfully cancelled, drop the refcount of client_state */
 		ao2_ref(client_state, -1);
 	}
@@ -1129,8 +1130,8 @@ static struct sip_outbound_registration_state *sip_outbound_registration_state_a
 	}
 
 	state->client_state->status = SIP_REGISTRATION_UNREGISTERED;
-	state->client_state->timer.user_data = state->client_state;
-	state->client_state->timer.cb = sip_outbound_registration_timer_cb;
+	pj_timer_entry_init(&state->client_state->timer, 0, state->client_state,
+		sip_outbound_registration_timer_cb);
 	state->client_state->transport_name = ast_strdup(registration->transport);
 	state->client_state->registration_name =
 		ast_strdup(ast_sorcery_object_get_id(registration));

res/res_pjsip_session.c

@@ -2702,10 +2702,8 @@ int ast_sip_session_defer_termination(struct ast_sip_session *session)
 	session->defer_end = 1;
 	session->ended_while_deferred = 0;
 
-	session->scheduled_termination.id = 0;
 	ao2_ref(session, +1);
-	session->scheduled_termination.user_data = session;
-	session->scheduled_termination.cb = session_termination_cb;
+	pj_timer_entry_init(&session->scheduled_termination, 0, session, session_termination_cb);
 
 	res = (pjsip_endpt_schedule_timer(ast_sip_get_pjsip_endpoint(),
 		&session->scheduled_termination, &delay) != PJ_SUCCESS) ? -1 : 0;
@@ -2727,8 +2725,8 @@ int ast_sip_session_defer_termination(struct ast_sip_session *session)
  */
 static void sip_session_defer_termination_stop_timer(struct ast_sip_session *session)
 {
-	if (pj_timer_heap_cancel(pjsip_endpt_get_timer_heap(ast_sip_get_pjsip_endpoint()),
-		&session->scheduled_termination)) {
+	if (pj_timer_heap_cancel_if_active(pjsip_endpt_get_timer_heap(ast_sip_get_pjsip_endpoint()),
+		&session->scheduled_termination, session->scheduled_termination.id)) {
 		ao2_ref(session, -1);
 	}
 }

res/res_pjsip_t38.c

@@ -142,7 +142,8 @@ static void t38_change_state(struct ast_sip_session *session, struct ast_sip_ses
 		new_state, old_state,
 		session->channel ? ast_channel_name(session->channel) : "<gone>");
 
-	if (pj_timer_heap_cancel(pjsip_endpt_get_timer_heap(ast_sip_get_pjsip_endpoint()), &state->timer)) {
+	if (pj_timer_heap_cancel_if_active(pjsip_endpt_get_timer_heap(ast_sip_get_pjsip_endpoint()),
+		&state->timer, 0)) {
 		ast_debug(2, "Automatic T.38 rejection on channel '%s' terminated\n",
 			session->channel ? ast_channel_name(session->channel) : "<gone>");
 		ao2_ref(session, -1);
@@ -248,8 +249,7 @@ static struct t38_state *t38_state_get_or_alloc(struct ast_sip_session *session)
 	state = datastore->data;
 
 	/* This will get bumped up before scheduling */
-	state->timer.user_data = session;
-	state->timer.cb = t38_automatic_reject_timer_cb;
+	pj_timer_entry_init(&state->timer, 0, session, t38_automatic_reject_timer_cb);
 
 	datastore->data = state;