From e42d8aef241b87a694dfcee67047ca9bc9173fab Mon Sep 17 00:00:00 2001
From: Mike McCormack <mike@codeweavers.com>
Date: Thu, 15 Jul 2004 22:07:44 +0000
Subject: [PATCH] Fix a few serious race conditions in the OLE object pipe
 server.

---
 dlls/ole32/compobj.c | 38 ++++++++++++++++----------------------
 dlls/ole32/rpc.c     |  1 +
 2 files changed, 17 insertions(+), 22 deletions(-)

diff --git a/dlls/ole32/compobj.c b/dlls/ole32/compobj.c
index 8cd06d8e247..96cc86e8901 100644
--- a/dlls/ole32/compobj.c
+++ b/dlls/ole32/compobj.c
@@ -1094,29 +1094,23 @@ _LocalServerThread(LPVOID param) {
     }
     IStream_Release(pStm);
 
-    while (1) {
-	hPipe = CreateNamedPipeA(
-	    pipefn,
-	    PIPE_ACCESS_DUPLEX,
-	    PIPE_TYPE_BYTE|PIPE_WAIT,
-	    PIPE_UNLIMITED_INSTANCES,
-	    4096,
-	    4096,
-	    NMPWAIT_USE_DEFAULT_WAIT,
-	    NULL
-	);
-	if (hPipe == INVALID_HANDLE_VALUE) {
-	    FIXME("pipe creation failed for %s, le is %lx\n",pipefn,GetLastError());
-	    return 1;
-	}
-	if (!ConnectNamedPipe(hPipe,NULL)) {
-	    ERR("Failure during ConnectNamedPipe %lx, ABORT!\n",GetLastError());
-	    CloseHandle(hPipe);
-	    continue;
-	}
-	WriteFile(hPipe,buffer,buflen,&res,NULL);
-	CloseHandle(hPipe);
+    hPipe = CreateNamedPipeA( pipefn, PIPE_ACCESS_DUPLEX,
+               PIPE_TYPE_BYTE|PIPE_WAIT, PIPE_UNLIMITED_INSTANCES,
+               4096, 4096, NMPWAIT_USE_DEFAULT_WAIT, NULL );
+    if (hPipe == INVALID_HANDLE_VALUE) {
+        FIXME("pipe creation failed for %s, le is %lx\n",pipefn,GetLastError());
+        return 1;
     }
+    while (1) {
+        if (!ConnectNamedPipe(hPipe,NULL)) {
+            ERR("Failure during ConnectNamedPipe %lx, ABORT!\n",GetLastError());
+            break;
+        }
+        WriteFile(hPipe,buffer,buflen,&res,NULL);
+        FlushFileBuffers(hPipe);
+        DisconnectNamedPipe(hPipe);
+    }
+    CloseHandle(hPipe);
     return 0;
 }
 
diff --git a/dlls/ole32/rpc.c b/dlls/ole32/rpc.c
index c84bc3fbbbf..44e0594f377 100644
--- a/dlls/ole32/rpc.c
+++ b/dlls/ole32/rpc.c
@@ -512,6 +512,7 @@ HRESULT create_marshalled_proxy(REFCLSID rclsid, REFIID iid, LPVOID *ppv) {
   WINE_StringFromCLSID(rclsid,pipefn+strlen(PIPEPREF));
 
   while (tries++<MAXTRIES) {
+      WaitNamedPipeA( pipefn, NMPWAIT_WAIT_FOREVER );
       hPipe	= CreateFileA(
 	      pipefn,
 	      GENERIC_READ|GENERIC_WRITE,