Re: [ros-dev] [ros-diffs] [mjmartin] 47393: [win32k] - The timer is created usingUserCreateObject. It may be a good idea to save the handle in the timer object so that it can be deleted later. - Dereference the object before attempting to delete it.

[James Tabor]

Locks?

On Sun, May 30, 2010 at 6:41 AM, Ged Murphy [e-mail] wrote:
> There's no lock on the list access.
>
> On 29 May 2010 07:51, [e-mail] wrote:
> > Author: mjmartin
> > Date: Sat May 29 08:51:03 2010
> > New Revision: 47393
> >
> > URL: http://svn.reactos.org/svn/reactos?rev=47393&view=rev
> > Log:
> > [win32k]
> > The timer is created usingUserCreateObject. It may be a good idea to
> >
> > save the handle in the timer object so that it can be deleted later.
> > Dereference the object before attempting to delete it.
> >
> > Modified:
> >    trunk/reactos/subsystems/win32/win32k/ntuser/timer.c
> >   FirstpTmr = UserCreateObject(gHandleTable, NULL, &Handle, otTimer,
> >
> > sizeof(TIMER));
> >  if (FirstpTmr) InitializeListHead(&FirstpTmr->ptmrList);
> >  if (FirstpTmr)
> >  {
> >     FirstpTmr->head.h = Handle;
> >     InitializeListHead(&FirstpTmr->ptmrList);
> >  }
> > Ret = FirstpTmr;
> > }

UserCreateObject already sets the header handle and cLockObj!

from object.c, UserCreateObject:
{
<snip ,,....>
   /* Now set default headers. */
   ((PHEAD)Object)->h = hi;
   ((PHEAD)Object)->cLockObj = 2; // we need this, because we create 2
refs: handle and pointer!

if (h)
      *h = hi;
   return Object;
}