Commit a28394a1 authored by Pekka Pessi's avatar Pekka Pessi

stun.c: try to avoid using stun handle after returning from discovery callback

Crash reported and partial patch by Daniele Rondina.

darcs-hash:20071220131337-65a35-b47bcc91842fda12aa66c72df5e76641f7e6059c.gz
parent b4ada69a
......@@ -1890,23 +1890,23 @@ static int process_test_lifetime(stun_request_t *req, stun_msg_t *binding_respon
if ((req->sr_state == stun_req_timeout) && (req->sr_from_y == -1)) {
SU_DEBUG_0(("%s: lifetime determination failed.\n", __func__));
sd->sd_state = stun_discovery_timeout;
req->sr_state = stun_req_dispose_me;
/* Use per discovery specific callback */
if (sd->sd_callback)
sd->sd_callback(sd->sd_magic, sh, sd, action, sd->sd_state);
req->sr_state = stun_req_dispose_me;
return 0;
}
if (abs(sd->sd_lt_cur - sd->sd_lt) <= STUN_LIFETIME_CI) {
sd->sd_state = stun_discovery_done;
req->sr_state = stun_req_dispose_me;
/* Use per discovery specific callback */
if (sd->sd_callback)
sd->sd_callback(sd->sd_magic, sh, sd, action, sd->sd_state);
req->sr_state = stun_req_dispose_me;
return 0;
}
......@@ -1993,12 +1993,11 @@ static int action_bind(stun_request_t *req, stun_msg_t *binding_response)
memcpy(sd->sd_addr_seen_outside, sa, sizeof(su_sockaddr_t));
sd->sd_state = stun_discovery_done;
req->sr_state = stun_req_dispose_me;
if (sd->sd_callback)
sd->sd_callback(sd->sd_magic, sh, sd, action, sd->sd_state);
req->sr_state = stun_req_dispose_me;
return 0;
}
......@@ -2048,9 +2047,9 @@ static void priv_mark_discovery_done(stun_discovery_t *sd,
stun_request_t *req)
{
sd->sd_state = stun_discovery_done;
req->sr_state = stun_req_dispose_me;
if (sd->sd_callback)
sd->sd_callback(sd->sd_magic, sh, sd, action, sd->sd_state);
req->sr_state = stun_req_dispose_me;
}
/**
......@@ -2285,12 +2284,12 @@ static void stun_sendto_timer_cb(su_root_magic_t *magic,
switch (action) {
case stun_action_binding_request:
sd->sd_state = stun_discovery_timeout;
req->sr_state = stun_req_dispose_me;
/* Use per discovery specific callback */
if (sd->sd_callback)
sd->sd_callback(sd->sd_magic, sh, sd, action, sd->sd_state);
req->sr_state = stun_req_dispose_me;
break;
case stun_action_test_nattype:
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment