--- linphone-1.6.0-orig/mediastreamer2/src/oss.c	2006-11-15 18:51:04.000000000 +0800
+++ linphone-1.6.0/mediastreamer2/src/oss.c	2007-03-20 17:00:51.000000000 +0800
@@ -319,8 +319,13 @@
 	mblk_t *rm=NULL;
 	d->pcmfd=oss_open(d->pcmdev,d->bits,d->stereo,d->rate,&bsize);
 	if (d->pcmfd>=0){
-		rtmpbuff=(uint8_t*)alloca(bsize);
-		wtmpbuff=(uint8_t*)alloca(bsize);
+		rtmpbuff=(uint8_t*)malloc(bsize);
+		wtmpbuff=(uint8_t*)malloc(bsize);
+		if(rtmpbuff == NULL || wtmpbuff == NULL) {
+			free(rtmpbuff);
+			free(wtmpbuff);
+			return NULL;
+		}
 	}
 	while(d->read_started || d->write_started){
 		if (d->pcmfd>=0){
@@ -378,10 +383,12 @@
 						/* drop the fragment if the buffer starts to fill up */
 						/* we got too much data: I prefer to empty the incoming buffer */
 						while (ms_bufferizer_get_avail(d->bufferizer)>bsize*4){
+							ms_mutex_lock(&d->mutex);
 							err=ms_bufferizer_read(d->bufferizer,wtmpbuff,bsize);
 							err=ms_bufferizer_read(d->bufferizer,wtmpbuff,bsize);
 							err=ms_bufferizer_read(d->bufferizer,wtmpbuff,bsize);
 							err=ms_bufferizer_read(d->bufferizer,wtmpbuff,bsize);
+							ms_mutex_unlock(&d->mutex);
 							c=c+err*4;
 							ms_warning("drop fragment when buffer gets too much data (%i - discarded:%i)", info.fragstotal - info.fragments, c);
 							if (err==0)
@@ -389,7 +396,9 @@
 						}
 
 					}else {
+						ms_mutex_lock(&d->mutex);
 						err=ms_bufferizer_read(d->bufferizer,wtmpbuff,bsize);
+						ms_mutex_unlock(&d->mutex);
 						err=write(d->pcmfd,wtmpbuff,bsize);
 						if (err<0){
 							ms_warning("Fail to write %i bytes from soundcard: %s",
@@ -410,6 +419,8 @@
 		close(d->pcmfd);
 		d->pcmfd=-1;
 	}
+	free(rtmpbuff);
+	free(wtmpbuff);
 	if (rm!=NULL) freemsg(rm);
 	/*reset to default parameters */
 	d->bits=16;