| commit | a7be4256f6081684e8fb0258564f9358eb36cfcf | |
| author | Kevin Puetz <PuetzKevinA@JohnDeere.com> | |
| Mon, 10 Oct 2022 23:31:08 +0000 (10 23:31 +0000) | ||
| committer | Alexandre Julliard <julliard@winehq.org> | |
| Tue, 11 Oct 2022 15:13:02 +0000 (11 17:13 +0200) | ||
| tree | 0506391c2d82806185d5c90d1af93059dc3824ee | treesnapshot (tar.gz zip) |
| parent | 59f39b325d2d90c09c8b346ba241dab182084c7b | commitdiff |
rpcrt4: Add a refcount owned by MIDL_STUB_MESSAGE.
In cases where this could have been use-after-free, exceptions were
caught/hidden by RpcTryFinally, but still lead to leaks since
NdrProxyFreeBuffer wasn't able to call IRPCChannelBuffer::FreeBuffer.
StdProxy_GetChannel() now AddRef() on its return value (used to set
__proxy_frame::_StubMsg::pRpcChannelBuffer), and NdrProxyFreeBuffer()
calls the corresponding Release() and clears the now-weak pointer.
This makes the behavior of these function match the observed test
results, and fixes the crash/leak when a proxy is released mid-Invoke.
In cases where this could have been use-after-free, exceptions were
caught/hidden by RpcTryFinally, but still lead to leaks since
NdrProxyFreeBuffer wasn't able to call IRPCChannelBuffer::FreeBuffer.
StdProxy_GetChannel() now AddRef() on its return value (used to set
__proxy_frame::_StubMsg::pRpcChannelBuffer), and NdrProxyFreeBuffer()
calls the corresponding Release() and clears the now-weak pointer.
This makes the behavior of these function match the observed test
results, and fixes the crash/leak when a proxy is released mid-Invoke.
| dlls/rpcrt4/cproxy.c | diffblobblamehistory | |
| dlls/rpcrt4/tests/cstub.c | diffblobblamehistory |