diff --git a/src/sip/sipcall.cpp b/src/sip/sipcall.cpp index dca849a2f..3a6a7e908 100644 --- a/src/sip/sipcall.cpp +++ b/src/sip/sipcall.cpp @@ -1329,7 +1329,10 @@ SIPCall::InvSessionDeleter::operator ()(pjsip_inv_session* inv) const noexcept { // prevent this from getting accessed in callbacks // JAMI_WARN: this is not thread-safe! + if (!inv) return; inv->mod_data[getSIPVoIPLink()->getModId()] = nullptr; + // NOTE: the counter is incremented by sipvoiplink (transaction_request_cb) + pjsip_inv_dec_ref(inv); } bool diff --git a/src/sip/sipvoiplink.cpp b/src/sip/sipvoiplink.cpp index aa055ba82..8995b100e 100644 --- a/src/sip/sipvoiplink.cpp +++ b/src/sip/sipvoiplink.cpp @@ -385,6 +385,11 @@ transaction_request_cb(pjsip_rx_data *rdata) pjsip_dlg_dec_lock(dialog); inv->mod_data[mod_ua_.id] = call.get(); + // NOTE: The invitation counter is managed by pjsip. If that counter goes down to zero + // the invite will be destroyed, and the unique_ptr will point freed datas. + // To avoid this, we increment the ref counter and let our unique_ptr manage + // when the invite will be freed + pjsip_inv_add_ref(inv); call->inv.reset(inv); // Check whether Replaces header is present in the request and process accordingly.