Skip to content

Commit 922b392

Browse files
lminierolminiero
authored
Add more checks on validity of NUA before using it in SIP plugin (#2247)
1 parent 9f40c11 commit 922b392

File tree

1 file changed

+68
-5
lines changed

1 file changed

+68
-5
lines changed

‎plugins/janus_sip.c

+68-5
Original file line numberDiff line numberDiff line change
@@ -2114,8 +2114,12 @@ void janus_sip_destroy_session(janus_plugin_session *handle, int *error) {
21142114
session->refer_id = 0;
21152115
}
21162116
/* Shutdown the NUA */
2117-
if(session->stack && session->stack->s_nua)
2118-
nua_shutdown(session->stack->s_nua);
2117+
if(session->stack) {
2118+
janus_mutex_lock(&session->stack->smutex);
2119+
if(session->stack->s_nua)
2120+
nua_shutdown(session->stack->s_nua);
2121+
janus_mutex_unlock(&session->stack->smutex);
2122+
}
21192123
g_hash_table_remove(sessions, handle);
21202124
janus_mutex_unlock(&sessions_mutex);
21212125
return;
@@ -2978,7 +2982,16 @@ static void *janus_sip_handler(void *data) {
29782982
char custom_params[2048];
29792983
janus_sip_parse_custom_contact_params(root, (char *)&custom_params, sizeof(custom_params));
29802984
/* Create a new NUA handle */
2985+
janus_mutex_lock(&session->stack->smutex);
2986+
if(session->stack->s_nua == NULL) {
2987+
janus_mutex_unlock(&session->stack->smutex);
2988+
JANUS_LOG(LOG_ERR, "NUA destroyed while registering?\n");
2989+
error_code = JANUS_SIP_ERROR_LIBSOFIA_ERROR;
2990+
g_snprintf(error_cause, 512, "Invalid NUA");
2991+
goto error;
2992+
}
29812993
session->stack->s_nh_r = nua_handle(session->stack->s_nua, session, TAG_END());
2994+
janus_mutex_unlock(&session->stack->smutex);
29822995
if(session->stack->s_nh_r == NULL) {
29832996
JANUS_LOG(LOG_ERR, "NUA Handle for REGISTER still null??\n");
29842997
error_code = JANUS_SIP_ERROR_LIBSOFIA_ERROR;
@@ -3090,16 +3103,34 @@ static void *janus_sip_handler(void *data) {
30903103
nh = g_hash_table_lookup(session->stack->subscriptions, (char *)event_type);
30913104
if(nh == NULL) {
30923105
/* We don't, create one now */
3093-
if(!session->helper)
3106+
if(!session->helper) {
3107+
janus_mutex_lock(&session->stack->smutex);
3108+
if(session->stack->s_nua == NULL) {
3109+
janus_mutex_unlock(&session->stack->smutex);
3110+
JANUS_LOG(LOG_ERR, "NUA destroyed while subscribing?\n");
3111+
error_code = JANUS_SIP_ERROR_LIBSOFIA_ERROR;
3112+
g_snprintf(error_cause, 512, "Invalid NUA");
3113+
goto error;
3114+
}
30943115
nh = nua_handle(session->stack->s_nua, session, TAG_END());
3095-
else {
3116+
janus_mutex_unlock(&session->stack->smutex);
3117+
} else {
30963118
/* This is a helper, we need to use the master's SIP stack */
30973119
if(session->master == NULL || session->master->stack == NULL) {
30983120
error_code = JANUS_SIP_ERROR_HELPER_ERROR;
30993121
g_snprintf(error_cause, 512, "Invalid master SIP stack");
31003122
goto error;
31013123
}
3124+
janus_mutex_lock(&session->master->stack->smutex);
3125+
if(session->master->stack->s_nua == NULL) {
3126+
janus_mutex_unlock(&session->master->stack->smutex);
3127+
JANUS_LOG(LOG_ERR, "NUA destroyed while subscribing?\n");
3128+
error_code = JANUS_SIP_ERROR_LIBSOFIA_ERROR;
3129+
g_snprintf(error_cause, 512, "Invalid NUA");
3130+
goto error;
3131+
}
31023132
nh = nua_handle(session->master->stack->s_nua, session, TAG_END());
3133+
janus_mutex_unlock(&session->master->stack->smutex);
31033134
}
31043135
if(session->stack->subscriptions == NULL) {
31053136
/* We still need a table for mapping these subscriptions as well */
@@ -3328,7 +3359,16 @@ static void *janus_sip_handler(void *data) {
33283359
if(session->stack->s_nh_i != NULL)
33293360
nua_handle_destroy(session->stack->s_nh_i);
33303361
if(!session->helper) {
3362+
janus_mutex_lock(&session->stack->smutex);
3363+
if(session->stack->s_nua == NULL) {
3364+
janus_mutex_unlock(&session->stack->smutex);
3365+
JANUS_LOG(LOG_ERR, "NUA destroyed while calling?\n");
3366+
error_code = JANUS_SIP_ERROR_LIBSOFIA_ERROR;
3367+
g_snprintf(error_cause, 512, "Invalid NUA");
3368+
goto error;
3369+
}
33313370
session->stack->s_nh_i = nua_handle(session->stack->s_nua, session, TAG_END());
3371+
janus_mutex_unlock(&session->stack->smutex);
33323372
if(session->account.display_name) {
33333373
g_snprintf(from_hdr, sizeof(from_hdr), "\"%s\" <%s>", session->account.display_name, session->account.identity);
33343374
} else {
@@ -3344,7 +3384,18 @@ static void *janus_sip_handler(void *data) {
33443384
g_snprintf(error_cause, 512, "Invalid master SIP stack");
33453385
goto error;
33463386
}
3387+
janus_mutex_lock(&session->master->stack->smutex);
3388+
if(session->master->stack->s_nua == NULL) {
3389+
janus_mutex_unlock(&session->master->stack->smutex);
3390+
g_free(sdp);
3391+
session->sdp = NULL;
3392+
janus_sdp_destroy(parsed_sdp);
3393+
error_code = JANUS_SIP_ERROR_LIBSOFIA_ERROR;
3394+
g_snprintf(error_cause, 512, "Invalid NUA");
3395+
goto error;
3396+
}
33473397
session->stack->s_nh_i = nua_handle(session->master->stack->s_nua, session, TAG_END());
3398+
janus_mutex_unlock(&session->master->stack->smutex);
33483399
if(session->master->account.display_name) {
33493400
g_snprintf(from_hdr, sizeof(from_hdr), "\"%s\" <%s>", session->master->account.display_name, session->master->account.identity);
33503401
} else {
@@ -6516,7 +6567,19 @@ gpointer janus_sip_sofia_thread(gpointer user_data) {
65166567
TAG_NULL());
65176568
su_root_run(session->stack->s_root);
65186569
/* When we get here, we're done */
6519-
nua_destroy(session->stack->s_nua);
6570+
janus_mutex_lock(&session->stack->smutex);
6571+
nua_t *s_nua = session->stack->s_nua;
6572+
session->stack->s_nua = NULL;
6573+
janus_mutex_unlock(&session->stack->smutex);
6574+
if(session->stack->s_nh_r != NULL) {
6575+
nua_handle_destroy(session->stack->s_nh_r);
6576+
session->stack->s_nh_r = NULL;
6577+
}
6578+
if(session->stack->s_nh_i != NULL) {
6579+
nua_handle_destroy(session->stack->s_nh_i);
6580+
session->stack->s_nh_i = NULL;
6581+
}
6582+
nua_destroy(s_nua);
65206583
su_root_destroy(session->stack->s_root);
65216584
session->stack->s_root = NULL;
65226585
janus_refcount_decrease(&session->ref);

0 commit comments

Comments
 (0)