From 164a4070db0df2fa33512cf0d0fa80404c2e395b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?R=C3=A9mi=20Bernon?= <rbernon@codeweavers.com>
Date: Sun, 22 May 2022 16:49:35 +0200
Subject: [PATCH] dsound: Avoid using pointer value after free.
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Rémi Bernon <rbernon@codeweavers.com>
---
 dlls/dsound/buffer.c  | 4 ++--
 dlls/dsound/capture.c | 6 +++---
 dlls/dsound/dsound.c  | 4 ++--
 dlls/dsound/duplex.c  | 2 +-
 dlls/dsound/propset.c | 2 +-
 5 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/dlls/dsound/buffer.c b/dlls/dsound/buffer.c
index eb87479b7df..799b64e0e38 100644
--- a/dlls/dsound/buffer.c
+++ b/dlls/dsound/buffer.c
@@ -1192,9 +1192,9 @@ void secondarybuffer_destroy(IDirectSoundBufferImpl *This)
         HeapFree(GetProcessHeap(), 0, This->filters);
     }
 
-    HeapFree(GetProcessHeap(), 0, This);
-
     TRACE("(%p) released\n", This);
+
+    HeapFree(GetProcessHeap(), 0, This);
 }
 
 BOOL secondarybuffer_is_audible(IDirectSoundBufferImpl *This)
diff --git a/dlls/dsound/capture.c b/dlls/dsound/capture.c
index a00748d95bf..2c3dd83e86d 100644
--- a/dlls/dsound/capture.c
+++ b/dlls/dsound/capture.c
@@ -109,8 +109,8 @@ static void capturebuffer_destroy(IDirectSoundCaptureBufferImpl *This)
     This->device->capture_buffer = NULL;
 
     HeapFree(GetProcessHeap(), 0, This->notifies);
-    HeapFree(GetProcessHeap(), 0, This);
     TRACE("(%p) released\n", This);
+    HeapFree(GetProcessHeap(), 0, This);
 }
 
 /*******************************************************************************
@@ -871,8 +871,8 @@ static ULONG DirectSoundCaptureDevice_Release(
         HeapFree(GetProcessHeap(), 0, device->pwfx);
         device->lock.DebugInfo->Spare[0] = 0;
         DeleteCriticalSection( &(device->lock) );
+        TRACE("(%p) released\n", device);
         HeapFree(GetProcessHeap(), 0, device);
-	TRACE("(%p) released\n", device);
     }
     return ref;
 }
@@ -1099,8 +1099,8 @@ static void capture_destroy(IDirectSoundCaptureImpl *This)
 {
     if (This->device)
         DirectSoundCaptureDevice_Release(This->device);
-    HeapFree(GetProcessHeap(),0,This);
     TRACE("(%p) released\n", This);
+    HeapFree(GetProcessHeap(),0,This);
 }
 
 /*******************************************************************************
diff --git a/dlls/dsound/dsound.c b/dlls/dsound/dsound.c
index 346cc4ceca3..f2aea64eeed 100644
--- a/dlls/dsound/dsound.c
+++ b/dlls/dsound/dsound.c
@@ -239,8 +239,8 @@ static ULONG DirectSoundDevice_Release(DirectSoundDevice * device)
         HeapFree(GetProcessHeap(), 0, device->buffer);
         device->mixlock.DebugInfo->Spare[0] = 0;
         DeleteCriticalSection(&device->mixlock);
-        HeapFree(GetProcessHeap(),0,device);
         TRACE("(%p) released\n", device);
+        HeapFree(GetProcessHeap(),0,device);
     }
     return ref;
 }
@@ -670,8 +670,8 @@ static void directsound_destroy(IDirectSoundImpl *This)
 {
     if (This->device)
         DirectSoundDevice_Release(This->device);
-    HeapFree(GetProcessHeap(),0,This);
     TRACE("(%p) released\n", This);
+    HeapFree(GetProcessHeap(),0,This);
 }
 
 static inline IDirectSoundImpl *impl_from_IUnknown(IUnknown *iface)
diff --git a/dlls/dsound/duplex.c b/dlls/dsound/duplex.c
index a3a9a066c31..b7891caa410 100644
--- a/dlls/dsound/duplex.c
+++ b/dlls/dsound/duplex.c
@@ -61,8 +61,8 @@ static void fullduplex_destroy(IDirectSoundFullDuplexImpl *This)
         while(IDirectSoundCapture_Release(dsc8) > 0);
         IUnknown_Release(This->dsc8_unk);
     }
-    HeapFree(GetProcessHeap(), 0, This);
     TRACE("(%p) released\n", This);
+    HeapFree(GetProcessHeap(), 0, This);
 }
 
 /*******************************************************************************
diff --git a/dlls/dsound/propset.c b/dlls/dsound/propset.c
index 74d66cad68e..f42cfbf4163 100644
--- a/dlls/dsound/propset.c
+++ b/dlls/dsound/propset.c
@@ -91,8 +91,8 @@ static ULONG WINAPI IKsPrivatePropertySetImpl_Release(LPKSPROPERTYSET iface)
     TRACE("(%p) ref %ld\n", This, ref);
 
     if (!ref) {
+        TRACE("(%p) released\n", This);
         HeapFree(GetProcessHeap(), 0, This);
-	TRACE("(%p) released\n", This);
     }
     return ref;
 }