mirror of https://github.com/sipwise/sems.git
Normal shutdown already triggers the `clearRtpReceiverRelay()` in `AmB2BSession::onBeforeDestroy()`, so the destructor should actually normally see `media_session` ptr nulled. But it seems in some of the fork/transfer related scenarios this doesn't happen. So adding the defensive clean-up on the same manner the destructor of the `CallLeg` has (it uses the `releaseMediaSession()`, which is essentially the same: `stop()`; `releaseReference()` and NULLing), makes it consistent with these other_legs cleanup. The main reason is caused by a call leg (`AmB2BSession`), which was freed while the `AmB2BMedia::a` / `AmB2BMedia::b` still points to it. In this case we can crash during the media-thread DTMF processing. This fix is a hardening rather than a fix of the root cause. The root cause still is related to the cleanup path: certain call leg gets torn down through the path that skips (or maybe even races) the normal `onBeforeDestroy()`/`clearRtpReceiverRelay()` cleanup, leaving its shared `AmB2BMedia` with a dangling `a` or `b` pointer. Meanwhile the `a` / `b` are raw, non-owned pointers, which may remain dangling. Change-Id: Ia1ee42a27014d2086b37a787f8555e6d7681d4a8mr26.2
parent
1c4e206c53
commit
5e412586e5
Loading…
Reference in new issue