From ab2d15d5243d893dadecf918b1d991f7137f04a2 Mon Sep 17 00:00:00 2001
From: winlin <winlin@vip.126.com>
Date: Thu, 21 May 2020 21:59:30 +0800
Subject: [PATCH] RTC: Fix dup release bug

---
 trunk/src/app/srs_app_rtc_conn.cpp   |  1 +
 trunk/src/app/srs_app_rtc_conn.hpp   |  2 ++
 trunk/src/app/srs_app_rtc_server.cpp | 18 ++++++++++--------
 3 files changed, 13 insertions(+), 8 deletions(-)

diff --git a/trunk/src/app/srs_app_rtc_conn.cpp b/trunk/src/app/srs_app_rtc_conn.cpp
index 6e410a93e..0b4ce7645 100644
--- a/trunk/src/app/srs_app_rtc_conn.cpp
+++ b/trunk/src/app/srs_app_rtc_conn.cpp
@@ -1927,6 +1927,7 @@ SrsRtcSession::SrsRtcSession(SrsRtcServer* s)
     state_ = INIT;
     last_stun_time = 0;
     sessionStunTimeout = 0;
+    disposing_ = false;
 
     blackhole = false;
     blackhole_addr = NULL;
diff --git a/trunk/src/app/srs_app_rtc_conn.hpp b/trunk/src/app/srs_app_rtc_conn.hpp
index 2370da467..8b39c00bd 100644
--- a/trunk/src/app/srs_app_rtc_conn.hpp
+++ b/trunk/src/app/srs_app_rtc_conn.hpp
@@ -321,6 +321,8 @@ class SrsRtcSession
     friend class SrsRtcDtls;
     friend class SrsRtcPlayer;
     friend class SrsRtcPublisher;
+public:
+    bool disposing_;
 private:
     SrsRtcServer* server_;
     SrsRtcSessionStateType state_;
diff --git a/trunk/src/app/srs_app_rtc_server.cpp b/trunk/src/app/srs_app_rtc_server.cpp
index faa9c78c9..e69d66cd9 100644
--- a/trunk/src/app/srs_app_rtc_server.cpp
+++ b/trunk/src/app/srs_app_rtc_server.cpp
@@ -411,6 +411,11 @@ srs_error_t SrsRtcServer::setup_session2(SrsRtcSession* session, SrsRequest* req
 
 void SrsRtcServer::destroy(SrsRtcSession* session)
 {
+    if (session->disposing_) {
+        return;
+    }
+    session->disposing_ = true;
+
     std::map<std::string, SrsRtcSession*>::iterator it;
 
     if ((it = map_username_session.find(session->username())) != map_username_session.end()) {
@@ -421,9 +426,7 @@ void SrsRtcServer::destroy(SrsRtcSession* session)
         map_id_session.erase(it);
     }
 
-    if (::find(zombies_.begin(), zombies_.end(), session) == zombies_.end()) {
-        zombies_.push_back(session);
-    }
+    zombies_.push_back(session);
 }
 
 bool SrsRtcServer::insert_into_id_sessions(const string& peer_id, SrsRtcSession* session)
@@ -446,18 +449,17 @@ void SrsRtcServer::check_and_clean_timeout_session()
         // Now, we got the RTC session to cleanup, switch to its context
         // to make all logs write to the "correct" pid+cid.
         session->switch_to_context();
-
         srs_trace("rtc session=%s, STUN timeout", session->id().c_str());
+
+        session->disposing_ = true;
+        zombies_.push_back(session);
+
         iter = map_username_session.erase(iter);
         map_id_session.erase(session->peer_id());
 
         if (handler) {
             handler->on_timeout(session);
         }
-
-        if (::find(zombies_.begin(), zombies_.end(), session) == zombies_.end()) {
-            zombies_.push_back(session);
-        }
     }
 }