ReceiveTempSMS
/
Sweden-Number
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

mfplat/sample: Fix use-after-free of a critical section. 

Signed-off-by: Nikolay Sivov <nsivov@codeweavers.com>
Signed-off-by: Alexandre Julliard <julliard@winehq.org>
This commit is contained in:
Nikolay Sivov 2022-05-10 19:13:24 +03:00 committed by Alexandre Julliard
parent 048e21d22e
commit 1d7d3f58d6
1 changed files with 5 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
dlls/mfplat/sample.c
View File

@ -183,22 +183,25 @@ static ULONG WINAPI sample_tracked_Release(IMFSample *iface)
{
struct sample *sample = impl_from_IMFSample(iface);
ULONG refcount = InterlockedDecrement(&sample->attributes.ref);
IRtwqAsyncResult *tracked_result = NULL;
HRESULT hr;
EnterCriticalSection(&sample->attributes.cs);
if (sample->tracked_result && sample->tracked_refcount == refcount)
{
IRtwqAsyncResult *tracked_result = sample->tracked_result;
tracked_result = sample->tracked_result;
sample->tracked_result = NULL;
sample->tracked_refcount = 0;
/* Call could fail if queue system is not initialized, it's not critical. */
if (FAILED(hr = RtwqInvokeCallback(tracked_result)))
WARN("Failed to invoke tracking callback, hr %#lx.\n", hr);
IRtwqAsyncResult_Release(tracked_result);
}
LeaveCriticalSection(&sample->attributes.cs);
if (tracked_result)
IRtwqAsyncResult_Release(tracked_result);
TRACE("%p, refcount %lu.\n", iface, refcount);
if (!refcount)