| commit | 8713e2ad6497e6eba63a4dd7136d47a80a430815 | |
| author | Gabriel Ivăncescu <gabrielopcode@gmail.com> | |
| Tue, 18 Jul 2023 17:44:07 +0000 (18 20:44 +0300) | ||
| committer | Alexandre Julliard <julliard@winehq.org> | |
| Wed, 19 Jul 2023 14:54:46 +0000 (19 16:54 +0200) | ||
| tree | e25850020f112dedca1f140aa16a4693de107e29 | treesnapshot (tar.gz zip) |
| parent | b8950d04e439f649f2167477a36ee453ad8b81ef | commitdiff |
mshtml: Grab the binding while aborting it.
Holding the BindStatusCallback ref is not enough; Abort can end up calling
OnStopBinding which intentionally removes the binding and releases its
ref. urlmon's Abort will then have a use-after-free when accessing the
state to set BINDING_ABORTED, if it was destroyed.
Signed-off-by: Gabriel Ivăncescu <gabrielopcode@gmail.com>
Holding the BindStatusCallback ref is not enough; Abort can end up calling
OnStopBinding which intentionally removes the binding and releases its
ref. urlmon's Abort will then have a use-after-free when accessing the
state to set BINDING_ABORTED, if it was destroyed.
Signed-off-by: Gabriel Ivăncescu <gabrielopcode@gmail.com>
| dlls/mshtml/navigate.c | diffblobblamehistory |