Change in osmo-msc[master]: release RTP stream only for matching CC transaction

[Neels Hofmeyr]

Neels Hofmeyr has submitted this change and it was merged. ( https://gerrit.osmocom.org/12397 )

Change subject: release RTP stream only for matching CC transaction
......................................................................

release RTP stream only for matching CC transaction

Do not break the currently ongoing call when rejecting a second incoming
caller.

There may be multiple (up to seven) simultaneous CC transactions, and there is
one mgcp_ctx for the currently active RTP stream.

Release the MGCP context only when the active CC transaction is releasing.
Before this patch, any CC transaction release would destroy the single MGCP
context, possibly breaking the currently ongoing call (another CC trans).

This also fixes a possible use-after-free if there were pending MGCP message
responses for the MGCP context; they are canceled properly for a released
transaction, but since one transaction would free the other transaction's MGCP
state, the clean up did not take place and possibly caused an mgcp client
response handling to access a freed mgcp_ctx.

Related: OS#3735
Change-Id: I1f8746e7babfcd3028a4d2c0ba260c608c686c76
---
M src/libmsc/msc_mgcp.c
1 file changed, 6 insertions(+), 0 deletions(-)

Approvals:
  Harald Welte: Looks good to me, approved
  Jenkins Builder: Verified



diff --git a/src/libmsc/msc_mgcp.c b/src/libmsc/msc_mgcp.c
index 6170c10..23e68e7 100644
--- a/src/libmsc/msc_mgcp.c
+++ b/src/libmsc/msc_mgcp.c
@@ -1164,6 +1164,12 @@
 		return -EINVAL;
 	}
 
+	if (mgcp_ctx->trans != trans) {
+		LOGP(DMGCP, LOGL_DEBUG, "(ti %02x %s) call release for background CC transaction\n",
+		     trans->transaction_id, vlr_subscr_name(trans->vsub));
+		return 0;
+	}
+
 	LOGP(DMGCP, LOGL_DEBUG, "(ti %02x %s) Call release: tearing down MGW endpoint\n",
 	     trans->transaction_id, vlr_subscr_name(trans->vsub));
 

-- 
To view, visit https://gerrit.osmocom.org/12397
To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings

Gerrit-Project: osmo-msc
Gerrit-Branch: master
Gerrit-MessageType: merged
Gerrit-Change-Id: I1f8746e7babfcd3028a4d2c0ba260c608c686c76
Gerrit-Change-Number: 12397
Gerrit-PatchSet: 2
Gerrit-Owner: Neels Hofmeyr <nhofmeyr at sysmocom.de>
Gerrit-Reviewer: Harald Welte <laforge at gnumonks.org>
Gerrit-Reviewer: Jenkins Builder (1000002)
Gerrit-Reviewer: Neels Hofmeyr <nhofmeyr at sysmocom.de>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.osmocom.org/pipermail/gerrit-log/attachments/20190103/49f825d7/attachment.htm>