Changeset 1321

Timestamp:

01/26/08 20:27:22 (7 months ago)

Author:

bjornroche

Message:

fixed potential isues with accessing freed memory in Core Audio code when dealing with xruns

Location:

portaudio/branches/v19-devel/src/hostapi/coreaudio

Files:

• pa_mac_core_utilities.c (modified) (9 diffs)
• pa_mac_core_utilities.h (modified) (1 diff)

portaudio/branches/v19-devel/src/hostapi/coreaudio/pa_mac_core_utilities.c

@@ -61 +61 @@
 #include <libkern/OSAtomic.h>
 #include <strings.h>
+#include <pthread.h>
+#include "pa_memorybarrier.h"
 
 PaError PaMacCore_SetUnixError( int err, int line )
@@ -636 +638 @@
 typedef struct PaMacXRunListNode_s PaMacXRunListNode;
 
+/** Always empty, so that it can always be the one returned by
+    addToXRunListenerList. note that it's not a pointer. */
+static PaMacXRunListNode firstXRunListNode;
+static int xRunListSize;
+static pthread_mutex_t xrunMutex;
+
 OSStatus xrunCallback(
     AudioDeviceID inDevice, 
@@ -645 +653 @@
    PaMacXRunListNode *node = (PaMacXRunListNode *) inClientData;
 
-   node = node->next ; //skip the first node
-
-   for( ; node; node=node->next ) {
-      PaMacCoreStream *stream = node->stream;
-
-      if( stream->state != ACTIVE )
-         continue; //if the stream isn't active, we don't care if the device is dropping
-
-      if( isInput ) {
-         if( stream->inputDevice == inDevice )
-            OSAtomicOr32( paInputOverflow, (uint32_t *)&(stream->xrunFlags) );
-      } else {
-         if( stream->outputDevice == inDevice )
-            OSAtomicOr32( paOutputUnderflow, (uint32_t *)&(stream->xrunFlags) );
+   int ret = pthread_mutex_trylock( &xrunMutex ) ;
+
+   if( ret == 0 ) {
+
+      node = node->next ; //skip the first node
+
+      for( ; node; node=node->next ) {
+         PaUtil_ReadMemoryBarrier();
+         PaMacCoreStream *stream = node->stream;
+
+         if( stream->state != ACTIVE )
+            continue; //if the stream isn't active, we don't care if the device is dropping
+
+         if( isInput ) {
+            if( stream->inputDevice == inDevice )
+               OSAtomicOr32( paInputOverflow, (uint32_t *)&(stream->xrunFlags) );
+         } else {
+            if( stream->outputDevice == inDevice )
+               OSAtomicOr32( paOutputUnderflow, (uint32_t *)&(stream->xrunFlags) );
+         }
       }
+
+      pthread_mutex_unlock( &xrunMutex );
    }
 
@@ -665 +681 @@
 }
 
-/** Always empty, so that it can always be the one returned by
-    addToXRunListenerList. note that it's not a pointer. */
-static PaMacXRunListNode firstXRunListNode;
-static int xRunListSize;
-
-void initializeXRunListenerList()
+int initializeXRunListenerList()
 {
    xRunListSize = 0;
    bzero( (void *) &firstXRunListNode, sizeof(firstXRunListNode) );
-}
-void destroyXRunListenerList()
+   return pthread_mutex_init( &xrunMutex, NULL );
+}
+int destroyXRunListenerList()
 {
    PaMacXRunListNode *node;
@@ -685 +697 @@
    }
    xRunListSize = 0;
+   return pthread_mutex_destroy( &xrunMutex );
 }
 
 void *addToXRunListenerList( void *stream )
 {
+   pthread_mutex_lock( &xrunMutex );
    PaMacXRunListNode *newNode;
    // setup new node:
@@ -694 +708 @@
    newNode->stream = (PaMacCoreStream *) stream;
    newNode->next = firstXRunListNode.next;
+   PaUtil_WriteMemoryBarrier();
    // insert:
    firstXRunListNode.next = newNode;
+   pthread_mutex_unlock( &xrunMutex );
 
    return &firstXRunListNode;
@@ -702 +718 @@
 int removeFromXRunListenerList( void *stream )
 {
+   pthread_mutex_lock( &xrunMutex );
    PaMacXRunListNode *node, *prev;
    prev = &firstXRunListNode;
@@ -710 +727 @@
          --xRunListSize;
          prev->next = node->next;
+         PaUtil_WriteMemoryBarrier();
          free( node );
+         pthread_mutex_unlock( &xrunMutex );
          return xRunListSize;
       }
@@ -717 +736 @@
    }
 
+   pthread_mutex_unlock( &xrunMutex );
    // failure
    return xRunListSize;

portaudio/branches/v19-devel/src/hostapi/coreaudio/pa_mac_core_utilities.h

@@ -218 +218 @@
     void* inClientData ) ;
 
-void initializeXRunListenerList();
-void destroyXRunListenerList();
+/** returns zero on success or a unix style error code. */
+int initializeXRunListenerList();
+/** returns zero on success or a unix style error code. */
+int destroyXRunListenerList();
 
 /**Returns the list, so that it can be passed to CorAudio.*/