Fixed ticket #291: Free memory read in PUBLISH session
git-svn-id: https://svn.pjsip.org/repos/pjproject/trunk@1292 74dad513-b988-da41-8d7b-12977e46ad98
diff --git a/pjsip/src/pjsip-simple/publishc.c b/pjsip/src/pjsip-simple/publishc.c
index 0cb15a7..6096622 100644
--- a/pjsip/src/pjsip-simple/publishc.c
+++ b/pjsip/src/pjsip-simple/publishc.c
@@ -544,11 +544,18 @@
/* Call callback. */
if (expiration == 0xFFFF) expiration = -1;
+
+ /* Temporarily increment pending_tsx to prevent callback from
+ * destroying pubc.
+ */
+ ++pubc->pending_tsx;
+
call_callback(pubc, PJ_SUCCESS, tsx->status_code,
(rdata ? &rdata->msg_info.msg->line.status.reason
: pjsip_get_status_text(tsx->status_code)),
rdata, expiration);
+ --pubc->pending_tsx;
}
/* Delete the record if user destroy pubc during the callback. */