chan_pjsip: Fix a crash when direct media is enabled and an ACK is received after the channel is hung up.

(closes issue ASTERISK-22731)
Reported by: Kinsey Moore
........

Merged revisions 402064 from http://svn.asterisk.org/svn/asterisk/branches/12


git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@402065 65c4cc65-6c06-0410-ace0-fbb531ad65f3

channels/chan_pjsip.c

@@ -2046,7 +2046,7 @@ static void chan_pjsip_incoming_response(struct ast_sip_session *session, struct
 static int chan_pjsip_incoming_ack(struct ast_sip_session *session, struct pjsip_rx_data *rdata)
 {
 	if (rdata->msg_info.msg->line.req.method.id == PJSIP_ACK_METHOD) {
-		if (session->endpoint->media.direct_media.enabled) {
+		if (session->endpoint->media.direct_media.enabled && session->channel) {
 			ast_queue_control(session->channel, AST_CONTROL_SRCCHANGE);
 		}
 	}

include/asterisk/res_pjsip_session.h

@@ -190,6 +190,9 @@ struct ast_sip_session_supplement {
 	 * The reason is that the rdata passed into this function is a cloned rdata structure,
 	 * and its module data is not copied during the cloning operation.
 	 * If you need to get the dialog, you can get it via session->inv_session->dlg.
+	 *
+	 * \note
+	 * There is no guarantee that a channel will be present on the session when this is called.
      */
     int (*incoming_request)(struct ast_sip_session *session, struct pjsip_rx_data *rdata);
     /*! 
@@ -203,6 +206,9 @@ struct ast_sip_session_supplement {
 	 * The reason is that the rdata passed into this function is a cloned rdata structure,
 	 * and its module data is not copied during the cloning operation.
 	 * If you need to get the dialog, you can get it via session->inv_session->dlg.
+	 *
+	 * \note
+	 * There is no guarantee that a channel will be present on the session when this is called.
 	 */
     void (*incoming_response)(struct ast_sip_session *session, struct pjsip_rx_data *rdata);
     /*!