system/wine
system/wine
1
0
Fork 0
mirror of git://source.winehq.org/git/wine.git synced 2024-09-02 20:03:37 +00:00
Code Issues Packages Projects Releases Wiki Activity

rpcrt4: Don't free the argument if the freer was called, unless it's a simple ref.

Browse source 
In the simple reference case the freer will not see the top-level
pointer, so we need to free that here.

This fixes a double-free caused by commit 614afcefa3.

Signed-off-by: Huw Davies <huw@codeweavers.com>
Signed-off-by: Alexandre Julliard <julliard@winehq.org>
This commit is contained in:
Huw Davies 2017-11-08 11:19:56 +00:00 committed by Alexandre Julliard
parent 394e15e39c
commit b2667416c2
1 changed files with 8 additions and 9 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

17
dlls/rpcrt4/ndr_stubless.c
View file

@ -1137,6 +1137,11 @@ LONG_PTR __cdecl call_server_func(SERVER_ROUTINE func, unsigned char * args, uns
} }
#endif #endif
static inline BOOL param_needs_alloc( PARAM_ATTRIBUTES attr )
{
return attr.IsOut && !attr.IsIn && !attr.IsBasetype && !attr.IsByValue;
}
static LONG_PTR *stub_do_args(MIDL_STUB_MESSAGE *pStubMsg, static LONG_PTR *stub_do_args(MIDL_STUB_MESSAGE *pStubMsg,
PFORMAT_STRING pFormat, enum stubless_phase phase, PFORMAT_STRING pFormat, enum stubless_phase phase,
unsigned short number_of_params) unsigned short number_of_params)
@ -1172,20 +1177,14 @@ static LONG_PTR *stub_do_args(MIDL_STUB_MESSAGE *pStubMsg,
{ {
HeapFree(GetProcessHeap(), 0, *(void **)pArg); HeapFree(GetProcessHeap(), 0, *(void **)pArg);
} }
else if (params[i].attr.IsOut && else if (param_needs_alloc(params[i].attr) &&
!params[i].attr.IsIn && (!params[i].attr.MustFree || params[i].attr.IsSimpleRef))
!params[i].attr.IsBasetype &&
!params[i].attr.IsByValue)
{ {
if (*pTypeFormat != RPC_FC_BIND_CONTEXT) pStubMsg->pfnFree(*(void **)pArg); if (*pTypeFormat != RPC_FC_BIND_CONTEXT) pStubMsg->pfnFree(*(void **)pArg);
} }
break; break;
case STUBLESS_INITOUT: case STUBLESS_INITOUT:
if (!params[i].attr.IsIn && if (param_needs_alloc(params[i].attr) && !params[i].attr.ServerAllocSize)
params[i].attr.IsOut &&
!params[i].attr.IsBasetype &&
!params[i].attr.ServerAllocSize &&
!params[i].attr.IsByValue)
{ {
if (*pTypeFormat == RPC_FC_BIND_CONTEXT) if (*pTypeFormat == RPC_FC_BIND_CONTEXT)
{ {