Race condition in typical usage of DestroySemaphoreInfo

[email protected]
Newsgroups gmane.comp.video.image-magick.bugs
Organization http://freemail.web.de/
Message-ID <[email protected]>
Here's a typical usage of DestroySemaphoreInfo (as of ImageMagick
6.4.1-3):

  wand_semaphore=DestroySemaphoreInfo(wand_semaphore);

Unfortunately, there is a time window during which the variable
wand_semaphore is still non-NULL but the object pointed to no
longer exists causing problems if another thread happens to call
AcquireSemaphoreInfo.

I think a level of indirection to DestroySemaphoreInfo's
parameter should be added (instead of returning a pointer) and
NULL should be stored to the object pointed to by that parameter
while semaphore_mutex is still held.

I have seen crashes due to that problem. Just run

    for (;;)
      {
        MagickWand *wand = NewMagickWand ();
        DestroyMagickWand (wand);
      }

in two threads (without having other MagickWand objects allocated).

Fixing DestroySemaphoreInfo as described above isn't enough for making
this code work, I also had to extend the critical section over the
AcquireWandId function  (avoiding the double check pattern).
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.