We are currently migrating Bugzilla to GitHub issues.
Any changes made to the bug tracker now will be lost, so please do not post new bugs or make changes to them.
When we're done, all bug URLs will redirect to their equivalent location on the new bug tracker.

Bug 651 - Race condition in Mix_SetPanning, Mix_SetDistance, and Mix_SetPosition
Summary: Race condition in Mix_SetPanning, Mix_SetDistance, and Mix_SetPosition
Status: RESOLVED FIXED
Alias: None
Product: SDL_mixer
Classification: Unclassified
Component: misc (show other bugs)
Version: 1.2.8
Hardware: All All
: P2 critical
Assignee: Ryan C. Gordon
QA Contact: Sam Lantinga
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2008-12-06 16:17 UTC by Lee Salzman
Modified: 2009-10-10 19:59 UTC (History)
1 user (show)

See Also:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Lee Salzman 2008-12-06 16:17:24 UTC
There is a race condition in Mix_SetPanning, Mix_SetDistance, and Mix_SetPosition, where it retrieves/modifies the position_args structure without calling SDL_LockAudio/SDL_Unlock audio first.

So between the call to get_position_arg(), and where it actually sets values in the position_args structure, the mix_channels callback is freeing the structure when a channel is done playing. Thus the args get modified after the struct is freed.

This leads to crashes/unstable behavior when combined the nvidia's opengl driver, due to the driver allocating structures of the same exact size (and hence tends to reuse the same memory), which SDL is modifying after glibc's malloc has handed the memory off to nvidia's opengl driver.

SDL_LockAudio() must be called before get_position_arg(), the lock kept and released via SDL_UnlockAudio() only after Mix_RegisterEffect() has been called, to correct this, in all three of these functions, i.e.

SDL_LockAudio();
...
args = get_position_arg();
...
args->... = ...;
...
Mix_Register_Effect(..., args);
...
SDL_UnlockAudio();
Comment 1 Sam Lantinga 2009-09-26 02:17:19 UTC
Ryan, can you take a look at this?
Comment 2 Ryan C. Gordon 2009-10-10 19:59:28 UTC
Fixed in svn revision #5045.

--ryan.