Re: [ros-dev] [ros-diffs] [mjmartin] 47393: [win32k] - The timer is created usingUserCreateObject. It may be a good idea to save the handle in the timer object so that it can be deleted later. - Dereference the object before attempting to delete it.

[James Tabor]

Locks?

On Sun, May 30, 2010 at 6:41 AM, Ged Murphy <gedmurphy(a)gmail.com> wrote:
>   There's no lock on the list access.
>
>  On 29 May 2010 07:51, <mjmartin(a)svn.reactos.org> wrote:
> >
> > Author: mjmartin
> > Date: Sat May 29 08:51:03 2010
> > New Revision: 47393
> >
> > URL: http://svn.reactos.org/svn/reactos?rev=47393&view=rev
> > Log:
> > [win32k]
> > - The timer is created usingUserCreateObject. It may be a good idea to
> > save the handle in the timer object so that it can be deleted later.
> > - Dereference the object before attempting to delete it.
> >
> > Modified:
> >    trunk/reactos/subsystems/win32/win32k/ntuser/timer.c 
>  >       FirstpTmr = UserCreateObject(gHandleTable,
> NULL, &Handle, otTimer,
> > sizeof(TIMER));
> > -      if (FirstpTmr) InitializeListHead(&FirstpTmr->ptmrList);
> > +      if (FirstpTmr)
> > +      {
> > +         FirstpTmr->head.h = Handle;
> > +         InitializeListHead(&FirstpTmr->ptmrList);
> > +      }
> >       Ret = FirstpTmr;
> >   } 
UserCreateObject already sets the header handle and cLockObj!

from object.c, UserCreateObject:
{
<snip ,,....>
   /* Now set default headers. */
   ((PHEAD)Object)->h = hi;
   ((PHEAD)Object)->cLockObj = 2; // we need this, because we create 2
refs: handle and pointer!

   if (h)
      *h = hi;
   return Object;
}