Race condition in typical usage of DestroySemaphoreInfo
| Newsgroups | gmane.comp.video.image-magick.bugs |
|---|---|
| Organization | http://freemail.web.de/ |
| Message-ID | <[email protected]> |
Here's a typical usage of DestroySemaphoreInfo (as of ImageMagick
6.4.1-3):
wand_semaphore=DestroySemaphoreInfo(wand_semaphore);
Unfortunately, there is a time window during which the variable
wand_semaphore is still non-NULL but the object pointed to no
longer exists causing problems if another thread happens to call
AcquireSemaphoreInfo.
I think a level of indirection to DestroySemaphoreInfo's
parameter should be added (instead of returning a pointer) and
NULL should be stored to the object pointed to by that parameter
while semaphore_mutex is still held.
I have seen crashes due to that problem. Just run
for (;;)
{
MagickWand *wand = NewMagickWand ();
DestroyMagickWand (wand);
}
in two threads (without having other MagickWand objects allocated).
Fixing DestroySemaphoreInfo as described above isn't enough for making
this code work, I also had to extend the critical section over the
AcquireWandId function (avoiding the double check pattern).