Skip to content

W
wine-winehq
Commit b2667416 authored by Huw Davies's avatar Huw Davies Committed by Alexandre Julliard
Browse files
Options

rpcrt4: Don't free the argument if the freer was called, unless it's a simple ref.

In the simple reference case the freer will not see the top-level pointer, so we need to free that here. This fixes a double-free caused by commit 614afcef. Signed-off-by: 's avatarHuw Davies <huw@codeweavers.com> Signed-off-by: 's avatarAlexandre Julliard <julliard@winehq.org>
parent 394e15e3
Hide whitespace changes
Inline Side-by-side
Showing with 8 additions and 9 deletions
dlls/rpcrt4/ndr_stubless.c
View file @ b2667416
......@@ -1137,6 +1137,11 @@ LONG_PTR __cdecl call_server_func(SERVER_ROUTINE func, unsigned char * args, uns
}
#endif
static inline BOOL param_needs_alloc( PARAM_ATTRIBUTES attr )
{
return attr.IsOut && !attr.IsIn && !attr.IsBasetype && !attr.IsByValue;
}
static LONG_PTR *stub_do_args(MIDL_STUB_MESSAGE *pStubMsg,
PFORMAT_STRING pFormat, enum stubless_phase phase,
unsigned short number_of_params)
......@@ -1172,20 +1177,14 @@ static LONG_PTR *stub_do_args(MIDL_STUB_MESSAGE *pStubMsg,
{
HeapFree(GetProcessHeap(), 0, *(void **)pArg);
}
else if (params[i].attr.IsOut &&
!params[i].attr.IsIn &&
!params[i].attr.IsBasetype &&
!params[i].attr.IsByValue)
else if (param_needs_alloc(params[i].attr) &&
(!params[i].attr.MustFree || params[i].attr.IsSimpleRef))
{
if (*pTypeFormat != RPC_FC_BIND_CONTEXT) pStubMsg->pfnFree(*(void **)pArg);
}
break;
case STUBLESS_INITOUT:
if (!params[i].attr.IsIn &&
params[i].attr.IsOut &&
!params[i].attr.IsBasetype &&
!params[i].attr.ServerAllocSize &&
!params[i].attr.IsByValue)
if (param_needs_alloc(params[i].attr) && !params[i].attr.ServerAllocSize)
{
if (*pTypeFormat == RPC_FC_BIND_CONTEXT)
{
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment