Repository navigation
Fix: Windows share worker crashed when it started capturing game sound - #109
Merged
Merged
Conversation
The activation request for process loopback capture lives on the stack and is passed as a VT_BLOB PROPVARIANT. In windows 0.62 PROPVARIANT clears itself on drop, so CoTaskMemFree ran on stack memory and the worker aborted with heap corruption (0xc0000374) the first time a stream with game sound started. Keep the PROPVARIANT in ManuallyDrop. The new Windows test opens the capture of its own process three times; it aborts without the fix and passes with it.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
On Windows the share worker aborted with heap corruption (
0xc0000374) the first time a stream with game sound started, before any sound was captured.The process loopback request (
AUDIOCLIENT_ACTIVATION_PARAMS) lives on the stack and goes toActivateAudioInterfaceAsyncinside aVT_BLOBPROPVARIANT. Inwindows0.62,PROPVARIANTclears itself on drop, soPropVariantClearhanded the stack address toCoTaskMemFree. A backtrace in gdb showsPROPVARIANT::drop->FreePropVariantArrayWorker->RtlFreeHeapfromloopback::capture. It happens on every path throughactivate, whatever the system answers.The fix keeps the
PROPVARIANTinManuallyDrop. Nothing in it was ever ours to free.tests/loopback.rs(Windows only) opens the capture of the test's own process three times and passes whether the machine has sound or not. Run on Windows Server 2025 (build 26100, x86_64-pc-windows-gnu): without the fix the test binary aborts with0xc0000374; with it the test passes. With the fix, I captured a process playing a test file (peak -24 dBFS, RMS 0.035) in a signed-in session and ran it through the real host loop, jitter buffer, decoder and speakers for 60 s at three loss rates:What plays matches the source level; the 6 skipped packets at 0% come from capture bursts after short stalls (2 to 5 gaps over 30 ms per minute).
Checks:
cargo fmt --check,cargo clippy -D warnings(Linux workspace and the share worker for Windows),cargo test --workspaceon Linux.