[Linphone-users] linphone segfault when released without prior terminate

[Christian Spielberger]

Hi,
 
in some situations (e.g. io errors, SIP errors) call_released is called without
prior call_terminated. These leads to a segfault, later when 
linphone_core_iterate
is called, because the call object is freed but not removed from the calls list.

In my case (some kind of SIP error, which should not be discussed here) in
sal_op_call.c function process_dialog_terminated calls call_set_released without
prior p->base.root->callbacks.call_terminated, because it does not run into the 
BELLE_SIP_DIALOG_CONFIRMED case. Instead we have BELLE_SIP_DIALOG_EARLY. The 
call
state changes from LinphoneCallOutgoingEarlyMedia directly to 
LinphoneCallReleased.
 
There might be also some cases of call_set_released without prior termination in
function call_process_response. Maybe they also lead to a segfault.

I have linphone 3.9.1 with belle-sip 1.4.2.
 
Regards,
Christian Spielberger.