Bug 24109 - SoundPlayer corrupts memory, leading to crashes
Summary: SoundPlayer corrupts memory, leading to crashes
Alias: None
Product: Class Libraries
Classification: Mono
Component: System ()
Version: 3.4.0
Hardware: PC Linux
: --- normal
Target Milestone: Untriaged
Assignee: Bugzilla
Depends on:
Reported: 2014-10-28 12:58 UTC by Stephen McConnel
Modified: 2014-10-28 14:16 UTC (History)
2 users (show)

Is this bug a regression?: ---
Last known good build:

Notice (2018-05-24): bugzilla.xamarin.com is now in read-only mode.

Please join us on Visual Studio Developer Community and in the Xamarin and Mono organizations on GitHub to continue tracking issues. Bugzilla will remain available for reference in read-only mode. We will continue to work on open Bugzilla bugs, copy them to the new locations as needed for follow-up, and add the new items under Related Links.

Our sincere thanks to everyone who has contributed on this bug tracker over the years. Thanks also for your understanding as we make these adjustments and improvements for the future.

Please create a new report on GitHub or Developer Community with your current version information, steps to reproduce, and relevant error messages or log files if you are hitting an issue that looks similar to this resolved bug and you do not yet see a matching new report.

Related Links:

Description Stephen McConnel 2014-10-28 12:58:25 UTC
Using the sound player, even via the SystemSounds classes, leads to corrupted memory as shown by the follow stack trace output.  This has been causing crashes in a program we've been developing for some time.

*** Error in `/usr/bin/cli': double free or corruption (out): 0x00007f807c02c0b0 ***

  at <unknown> <0xffffffff>
  at (wrapper managed-to-native) Mono.Audio.AlsaDevice.snd_pcm_sw_params_free (intptr) <0xffffffff>
  at Mono.Audio.AlsaDevice.Dispose (bool) <0x00043>
  at Mono.Audio.AlsaDevice.Finalize () <0x00026>
  at (wrapper runtime-invoke) object.runtime_invoke_virtual_void__this__ (object,intptr,intptr,intptr) <0xffffffff>

Native stacktrace:

	/usr/bin/cli() [0x4b73d8]
	/lib/x86_64-linux-gnu/libpthread.so.0(+0x10340) [0x7f80a4449340]
	/lib/x86_64-linux-gnu/libc.so.6(gsignal+0x39) [0x7f80a40a9bb9]
	/lib/x86_64-linux-gnu/libc.so.6(abort+0x148) [0x7f80a40acfc8]
	/lib/x86_64-linux-gnu/libc.so.6(+0x73e14) [0x7f80a40e6e14]
	/lib/x86_64-linux-gnu/libc.so.6(+0x800ee) [0x7f80a40f30ee]

Debug info from gdb:

Could not attach to process.  If your uid matches the uid of the target
process, check the setting of /proc/sys/kernel/yama/ptrace_scope, or try
again as the root user.  For more details, see /etc/sysctl.d/10-ptrace.conf
ptrace: Operation not permitted.
No threads.

Got a SIGABRT while executing native code. This usually indicates
a fatal error in the mono runtime or one of the native libraries 
used by your application.

Aborted (core dumped)

The fix is fairly obvious (and easy) in mono/mcs/class/System/System.Media/AudioDevice.cs.  I'll submit a pull request shortly once I get it set up properly.  The code hasn't changed in the most recent pull from github, so it's still a bug on the bleeding edge.
Comment 1 Stephen McConnel 2014-10-28 13:15:00 UTC
I've submitted a pull request for a fix for this bug.

Comment 2 Miguel de Icaza [MSFT] 2014-10-28 14:16:54 UTC
Patch applied.