[Linphone-developers] stack overflow with oss

[Roy Huang]

Hi,

I am run linphone on a embedded platform, it is built with old version
linuxthread which has default pthread stack size 16kB. The soundcard
on my platform has a block size 16kB.

In the oss_thread, which call alloca two times with parameter of
soundcard's block size. alloca get memory from pthread stack and it
makes the stack overflow. The following patch let it get memory from
heap and it also add mutex to avoid competition.

--- linphone-1.6.0-orig/mediastreamer2/src/oss.c        2006-11-15
18:51:04.000000000 +0800
+++ linphone-1.6.0/mediastreamer2/src/oss.c     2007-03-20 17:00:51.000000000 
+0800
@@ -319,8 +319,13 @@
        mblk_t *rm=NULL;
        d->pcmfd=oss_open(d->pcmdev,d->bits,d->stereo,d->rate,&bsize);
        if (d->pcmfd>=0){
-               rtmpbuff=(uint8_t*)alloca(bsize);
-               wtmpbuff=(uint8_t*)alloca(bsize);
+               rtmpbuff=(uint8_t*)malloc(bsize);
+               wtmpbuff=(uint8_t*)malloc(bsize);
+               if(rtmpbuff == NULL || wtmpbuff == NULL) {
+                       free(rtmpbuff);
+                       free(wtmpbuff);
+                       return NULL;
+               }
        }
        while(d->read_started || d->write_started){
                if (d->pcmfd>=0){
@@ -378,10 +383,12 @@
                                                /* drop the fragment if the 
buffer starts to fill up */
                                                /* we got too much data: I 
prefer to empty the incoming buffer */
                                                while 
(ms_bufferizer_get_avail(d->bufferizer)>bsize*4){
+                                                       
ms_mutex_lock(&d->mutex);
                                                        
err=ms_bufferizer_read(d->bufferizer,wtmpbuff,bsize);
                                                        
err=ms_bufferizer_read(d->bufferizer,wtmpbuff,bsize);
                                                        
err=ms_bufferizer_read(d->bufferizer,wtmpbuff,bsize);
                                                        
err=ms_bufferizer_read(d->bufferizer,wtmpbuff,bsize);
+                                                       
ms_mutex_unlock(&d->mutex);
                                                        c=c+err*4;
                                                        ms_warning("drop 
fragment when buffer gets too much data (%i -
discarded:%i)", info.fragstotal - info.fragments, c);
                                                        if (err==0)
@@ -389,7 +396,9 @@
                                                }

                                        }else {
+                                               ms_mutex_lock(&d->mutex);
                                                
err=ms_bufferizer_read(d->bufferizer,wtmpbuff,bsize);
+                                               ms_mutex_unlock(&d->mutex);
                                                
err=write(d->pcmfd,wtmpbuff,bsize);
                                                if (err<0){
                                                        ms_warning("Fail to write %i 
bytes from soundcard: %s",
@@ -410,6 +419,8 @@
                close(d->pcmfd);
                d->pcmfd=-1;
        }
+       free(rtmpbuff);
+       free(wtmpbuff);
        if (rm!=NULL) freemsg(rm);
        /*reset to default parameters */
        d->bits=16;