ALSA: snd_pcm_hw_params_free() causing memory error

Question

I'm modifying some existing sound code and noticed that when it finishes writing configuration data to the hardware, the code doesn't call snd_pcm_hw_params_free(). The application, for legacy reasons, open and closes the sound hardware for every sound it plays. This has got to be causing memory leak because the snd_pcm_hw_params_t * is never being free'd. So I added a call to `snd_pcm_hw_params_free() and now get the following error:

[root@n00200C709F3D namb2]# ./freetest 
*** glibc detected *** ./freetest: free(): invalid pointer: 0xbfe39000 ***
======= Backtrace: =========
/lib/libc.so.6[0xb75dc595]
/lib/libc.so.6(cfree+0x59)[0xb75dc9d9]
/emsnamb/namb2/lib/libasound.so.2(snd_pcm_hw_params_free+0x1d)[0xb7707bad]
./freetest[0x804876b]
/lib/libc.so.6(__libc_start_main+0xdc)[0xb7588e9c]
./freetest(memset+0x31)[0x80485b1]
======= Memory map: ========
08048000-08049000 r-xp 00000000 00:0e 5413865    /var/tmp/namb2/freetest
08049000-0804a000 rwxp 00000000 00:0e 5413865    /var/tmp/namb2/freetest
0804a000-08094000 rwxp 00000000 00:00 0          [heap]
b74f1000-b74fc000 r-xp 00000000 fe:00 48544      /lib/libgcc_s-4.1.2-20080825.so.1
b74fc000-b74fd000 rwxp 0000a000 fe:00 48544      /lib/libgcc_s-4.1.2-20080825.so.1
b7506000-b7516000 rwxs 00000000 00:04 149192707  /SYSV0056a4d6 (deleted)
b7516000-b7526000 rwxs 00000000 00:0d 1789       /dev/snd/pcmC0D0p
b7526000-b7527000 rwxp 00000000 00:00 0 
b7527000-b752e000 r-xp 00000000 fe:00 48586      /lib/librt-2.5.so
b752e000-b752f000 r-xp 00006000 fe:00 48586      /lib/librt-2.5.so
b752f000-b7530000 rwxp 00007000 fe:00 48586      /lib/librt-2.5.so
b7530000-b7531000 rwxp 00000000 00:00 0 
b7531000-b7544000 r-xp 00000000 fe:00 48582      /lib/libpthread-2.5.so
b7544000-b7545000 r-xp 00013000 fe:00 48582      /lib/libpthread-2.5.so
b7545000-b7546000 rwxp 00014000 fe:00 48582      /lib/libpthread-2.5.so
b7546000-b7548000 rwxp 00000000 00:00 0 
b7548000-b754a000 r-xp 00000000 fe:00 48536      /lib/libdl-2.5.so
b754a000-b754b000 r-xp 00001000 fe:00 48536      /lib/libdl-2.5.so
b754b000-b754c000 rwxp 00002000 fe:00 48536      /lib/libdl-2.5.so
b754c000-b7571000 r-xp 00000000 fe:00 48557      /lib/libm-2.5.so
b7571000-b7572000 r-xp 00024000 fe:00 48557      /lib/libm-2.5.so
b7572000-b7573000 rwxp 00025000 fe:00 48557      /lib/libm-2.5.so
b7573000-b76b2000 r-xp 00000000 fe:00 48509      /lib/libc-2.5.so
b76b2000-b76b4000 r-xp 0013f000 fe:00 48509      /lib/libc-2.5.so
b76b4000-b76b5000 rwxp 00141000 fe:00 48509      /lib/libc-2.5.so
b76b5000-b76b8000 rwxp 00000000 00:00 0 
b76be000-b76bf000 rwxs 81000000 00:0d 1789       /dev/snd/pcmC0D0p
b76bf000-b76c0000 r-xs 80000000 00:0d 1789       /dev/snd/pcmC0D0p
b76c0000-b76c1000 rwxs 00000000 00:04 149159938  /SYSV0056a4d5 (deleted)
b76c1000-b779b000 r-xp 00000000 fe:00 48500      /lib/libasound.so.2.0.0
b779b000-b77a0000 rwxp 000d9000 fe:00 48500      /lib/libasound.so.2.0.0
b77a0000-b77a1000 rwxp 00000000 00:00 0 
b77a1000-b77a2000 r-xp 00000000 00:00 0          [vdso]
b77a2000-b77bc000 r-xp 00000000 fe:00 48490      /lib/ld-2.5.so
b77bc000-b77bd000 r-xp 00019000 fe:00 48490      /lib/ld-2.5.so
b77bd000-b77be000 rwxp 0001a000 fe:00 48490      /lib/ld-2.5.so
bfe1a000-bfe3b000 rwxp 00000000 00:00 0          [stack]
Aborted

A test program below shows this problem. Is this an indication that my installation of libasound is broken in some way?

#include <stdio.h>
#include <stdlib.h>
#include <errno.h>
#include <alsa/asoundlib.h>

int main(int argc, char *argv[])
{
    snd_pcm_t *handle;
    snd_pcm_hw_params_t *params;
    int rc;

    if((rc = snd_pcm_open(&handle, "default", SND_PCM_STREAM_PLAYBACK, 0)) < 0)
    {
        printf("Playback open error: %s\n", snd_strerror(rc));
        exit(EXIT_FAILURE);
    }

    /* Allocate a hardware parameters object. */
    snd_pcm_hw_params_alloca(&params);

    /* Fill it in with default values. */
    if (snd_pcm_hw_params_any(handle, params) < 0)
    {
        fprintf(stderr, "Can not configure this PCM device.\n");
        snd_pcm_close(handle);    
        return(-1);
    }

    /* Write the parameters to the driver */
    if ( (rc = snd_pcm_hw_params(handle, params)) < 0 )
    {
        fprintf(stderr, "unable to set hw parameters: %s\n", snd_strerror(rc));
        snd_pcm_close(handle);    
        return -1;
    }

    snd_pcm_hw_params_free(params);
    snd_pcm_close(handle);

    return 0;
}

Answer 1

The snd_pcm_hw_params_alloca() documentation says:

allocate an invalid snd_pcm_hw_params_t using standard alloca

The standard alloca() function allocates memory from the stack; this memory gets automatically freed when the function exits.

You can use snd_pcm_hw_params_free() only for an object allocated with snd_pcm_hw_params_malloc().