Skip to content
Snippets Groups Projects
Commit aa963129 authored by Yuxuan Shui's avatar Yuxuan Shui Committed by Alexandre Julliard
Browse files

rtworkq: Avoid use-after-free.

queue_release_pending_item releases the work_item reference but later
accesses `item->queue`, which is a potential use-after-free.
parent bf64ae26
No related branches found
No related tags found
1 merge request!4243rtworkq: free cancelled work items
......@@ -734,9 +734,10 @@ static HRESULT invoke_async_callback(IRtwqAsyncResult *result)
* removed from pending items when it got canceled. */
static BOOL queue_release_pending_item(struct work_item *item)
{
struct queue *queue = item->queue;
BOOL ret = FALSE;
EnterCriticalSection(&item->queue->cs);
EnterCriticalSection(&queue->cs);
if (item->key)
{
list_remove(&item->entry);
......@@ -744,7 +745,7 @@ static BOOL queue_release_pending_item(struct work_item *item)
item->key = 0;
IUnknown_Release(&item->IUnknown_iface);
}
LeaveCriticalSection(&item->queue->cs);
LeaveCriticalSection(&queue->cs);
return ret;
}
......
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment