Double unlocking in the ac_iterate

[ryancaicse]

Hi, developers, it seems there could be a double unlocking error when !reconfigure_audio_decoder(ac, ac->lp_sampling_rate, ac->lp_channel_count), where the lock ac->queue_mutex is released twice. Should it be a bug?

c-toxcore/toxav/audio.c

Lines 136 to 179 in 13cca67

	pthread_mutex_lock(ac->queue_mutex);
	struct JitterBuffer *const j_buf = (struct JitterBuffer *)ac->j_buf;
	int rc = 0;
	struct RTPMessage *msg = jbuf_read(j_buf, &rc);
	for (; msg != nullptr || rc == 2; msg = jbuf_read(j_buf, &rc)) {
	pthread_mutex_unlock(ac->queue_mutex);
	if (rc == 2) {
	LOGGER_DEBUG(ac->log, "OPUS correction");
	int fs = (ac->lp_sampling_rate * ac->lp_frame_duration) / 1000;
	rc = opus_decode(ac->decoder, nullptr, 0, temp_audio_buffer, fs, 1);
	} else {
	/* Get values from packet and decode. */
	/* NOTE: This didn't work very well */
	#if 0
	rc = convert_bw_to_sampling_rate(opus_packet_get_bandwidth(msg->data));
	if (rc != -1) {
	cs->last_packet_sampling_rate = rc;
	} else {
	LOGGER_WARNING(ac->log, "Failed to load packet values!");
	rtp_free_msg(msg);
	continue;
	}
	#endif
	/* Pick up sampling rate from packet */
	memcpy(&ac->lp_sampling_rate, msg->data, 4);
	ac->lp_sampling_rate = net_ntohl(ac->lp_sampling_rate);
	ac->lp_channel_count = opus_packet_get_nb_channels(msg->data + 4);
	/** NOTE: even though OPUS supports decoding mono frames with stereo decoder and vice versa,
	* it didn't work quite well.
	*/
	if (!reconfigure_audio_decoder(ac, ac->lp_sampling_rate, ac->lp_channel_count)) {
	LOGGER_WARNING(ac->log, "Failed to reconfigure decoder!");
	free(msg);
	continue;
	}

Best,

[nurupo]

After eyeballing it for some time, it does indeed look like a double-unlock is possible here. Calling pthread_mutex_lock(ac->queue_mutex); right before that continue; should fix that.