We are currently migrating Bugzilla to GitHub issues.
Any changes made to the bug tracker now will be lost, so please do not post new bugs or make changes to them.
When we're done, all bug URLs will redirect to their equivalent location on the new bug tracker.

Bug 651

Summary: Race condition in Mix_SetPanning, Mix_SetDistance, and Mix_SetPosition
Product: SDL_mixer Reporter: Lee Salzman <lsalzman>
Component: miscAssignee: Ryan C. Gordon <icculus>
Status: RESOLVED FIXED QA Contact: Sam Lantinga <slouken>
Severity: critical    
Priority: P2 CC: sezeroz
Version: 1.2.8   
Hardware: All   
OS: All   

Description Lee Salzman 2008-12-06 16:17:24 UTC
There is a race condition in Mix_SetPanning, Mix_SetDistance, and Mix_SetPosition, where it retrieves/modifies the position_args structure without calling SDL_LockAudio/SDL_Unlock audio first.

So between the call to get_position_arg(), and where it actually sets values in the position_args structure, the mix_channels callback is freeing the structure when a channel is done playing. Thus the args get modified after the struct is freed.

This leads to crashes/unstable behavior when combined the nvidia's opengl driver, due to the driver allocating structures of the same exact size (and hence tends to reuse the same memory), which SDL is modifying after glibc's malloc has handed the memory off to nvidia's opengl driver.

SDL_LockAudio() must be called before get_position_arg(), the lock kept and released via SDL_UnlockAudio() only after Mix_RegisterEffect() has been called, to correct this, in all three of these functions, i.e.

SDL_LockAudio();
...
args = get_position_arg();
...
args->... = ...;
...
Mix_Register_Effect(..., args);
...
SDL_UnlockAudio();
Comment 1 Sam Lantinga 2009-09-26 02:17:19 UTC
Ryan, can you take a look at this?
Comment 2 Ryan C. Gordon 2009-10-10 19:59:28 UTC
Fixed in svn revision #5045.

--ryan.