[tfaber] 63757: [QUARTZ][STRMBASE] - Fix use-after-free on critical sections, which caused test hangs. Also fix some memory leaks. More fixes coming with the next Wine-sync, but this should be enou...

Author: tfaber
Date: Tue Jul 29 07:49:06 2014
New Revision: 63757

URL: http://svn.reactos.org/svn/reactos?rev=63757&view=rev
Log:
[QUARTZ][STRMBASE]
- Fix use-after-free on critical sections, which caused test hangs. Also fix some memory
leaks. More fixes coming with the next Wine-sync, but this should be enough to get tests
working.
ROSTESTS-116

Modified:
    trunk/reactos/dll/directx/wine/quartz/enumfilters.c
    trunk/reactos/dll/directx/wine/quartz/filesource.c
    trunk/reactos/dll/directx/wine/quartz/nullrenderer.c
    trunk/reactos/dll/directx/wine/quartz/parser.c
    trunk/reactos/include/reactos/wine/strmbase.h
    trunk/reactos/lib/3rdparty/strmbase/filter.c
    trunk/reactos/lib/3rdparty/strmbase/renderer.c
    trunk/reactos/lib/3rdparty/strmbase/transform.c

Modified: trunk/reactos/dll/directx/wine/quartz/enumfilters.c
URL:
http://svn.reactos.org/svn/reactos/trunk/reactos/dll/directx/wine/quartz/en…
==============================================================================
--- trunk/reactos/dll/directx/wine/quartz/enumfilters.c	[iso-8859-1] (original)
+++ trunk/reactos/dll/directx/wine/quartz/enumfilters.c	[iso-8859-1] Tue Jul 29 07:49:06
2014
@@ -113,6 +113,7 @@
     if (!refCount)
     {
         IGraphVersion_Release(This->pVersionSource);
+        CoTaskMemFree(This);
         return 0;
     }
     else

Modified: trunk/reactos/dll/directx/wine/quartz/filesource.c
URL:
http://svn.reactos.org/svn/reactos/trunk/reactos/dll/directx/wine/quartz/fi…
==============================================================================
--- trunk/reactos/dll/directx/wine/quartz/filesource.c	[iso-8859-1] (original)
+++ trunk/reactos/dll/directx/wine/quartz/filesource.c	[iso-8859-1] Tue Jul 29 07:49:06
2014
@@ -465,7 +465,7 @@
 static ULONG WINAPI AsyncReader_Release(IBaseFilter * iface)
 {
     AsyncReader *This = impl_from_IBaseFilter(iface);
-    ULONG refCount = BaseFilterImpl_Release(iface);
+    ULONG refCount = InterlockedDecrement(&This->filter.refCount);
     
     TRACE("(%p)->() Release from %d\n", This, refCount + 1);
     
@@ -485,6 +485,7 @@
         CoTaskMemFree(This->pszFileName);
         if (This->pmt)
             FreeMediaType(This->pmt);
+        BaseFilter_Destroy(&This->filter);
         CoTaskMemFree(This);
         return 0;
     }

Modified: trunk/reactos/dll/directx/wine/quartz/nullrenderer.c
URL:
http://svn.reactos.org/svn/reactos/trunk/reactos/dll/directx/wine/quartz/nu…
==============================================================================
--- trunk/reactos/dll/directx/wine/quartz/nullrenderer.c	[iso-8859-1] (original)
+++ trunk/reactos/dll/directx/wine/quartz/nullrenderer.c	[iso-8859-1] Tue Jul 29 07:49:06
2014
@@ -108,7 +108,7 @@
 static ULONG WINAPI NullRendererInner_Release(IUnknown *iface)
 {
     NullRendererImpl *This = impl_from_IUnknown(iface);
-    ULONG refCount =
BaseFilterImpl_Release(&This->renderer.filter.IBaseFilter_iface);
+    ULONG refCount =
BaseRendererImpl_Release(&This->renderer.filter.IBaseFilter_iface);
 
     if (!refCount)
     {

Modified: trunk/reactos/dll/directx/wine/quartz/parser.c
URL:
http://svn.reactos.org/svn/reactos/trunk/reactos/dll/directx/wine/quartz/pa…
==============================================================================
--- trunk/reactos/dll/directx/wine/quartz/parser.c	[iso-8859-1] (original)
+++ trunk/reactos/dll/directx/wine/quartz/parser.c	[iso-8859-1] Tue Jul 29 07:49:06 2014
@@ -180,6 +180,7 @@
     }
 
     CoTaskMemFree(This->ppPins);
+    BaseFilter_Destroy(&This->filter);
 
     TRACE("Destroying parser\n");
     CoTaskMemFree(This);
@@ -188,7 +189,7 @@
 ULONG WINAPI Parser_Release(IBaseFilter * iface)
 {
     ParserImpl *This = impl_from_IBaseFilter(iface);
-    ULONG refCount = BaseFilterImpl_Release(iface);
+    ULONG refCount = InterlockedDecrement(&This->filter.refCount);
 
     TRACE("(%p)->() Release from %d\n", This, refCount + 1);
 

Modified: trunk/reactos/include/reactos/wine/strmbase.h
URL:
http://svn.reactos.org/svn/reactos/trunk/reactos/include/reactos/wine/strmb…
==============================================================================
--- trunk/reactos/include/reactos/wine/strmbase.h	[iso-8859-1] (original)
+++ trunk/reactos/include/reactos/wine/strmbase.h	[iso-8859-1] Tue Jul 29 07:49:06 2014
@@ -194,6 +194,7 @@
 VOID WINAPI BaseFilterImpl_IncrementPinVersion(BaseFilter* This);
 
 HRESULT WINAPI BaseFilter_Init(BaseFilter * This, const IBaseFilterVtbl *Vtbl, const
CLSID *pClsid, DWORD_PTR DebugInfo, const BaseFilterFuncTable* pBaseFuncsTable);
+HRESULT WINAPI BaseFilter_Destroy(BaseFilter * This);
 
 /* Enums */
 HRESULT WINAPI EnumMediaTypes_Construct(BasePin *iface, BasePin_GetMediaType enumFunc,
BasePin_GetMediaTypeVersion versionFunc, IEnumMediaTypes ** ppEnum);

Modified: trunk/reactos/lib/3rdparty/strmbase/filter.c
URL:
http://svn.reactos.org/svn/reactos/trunk/reactos/lib/3rdparty/strmbase/filt…
==============================================================================
--- trunk/reactos/lib/3rdparty/strmbase/filter.c	[iso-8859-1] (original)
+++ trunk/reactos/lib/3rdparty/strmbase/filter.c	[iso-8859-1] Tue Jul 29 07:49:06 2014
@@ -60,14 +60,7 @@
     TRACE("(%p)->() Release from %d\n", This, refCount + 1);
 
     if (!refCount)
-    {
-        if (This->pClock)
-            IReferenceClock_Release(This->pClock);
-
-        This->IBaseFilter_iface.lpVtbl = NULL;
-        This->csFilter.DebugInfo->Spare[0] = 0;
-        DeleteCriticalSection(&This->csFilter);
-    }
+        BaseFilter_Destroy(This);
 
     return refCount;
 }
@@ -209,3 +202,15 @@
 
     return S_OK;
 }
+
+HRESULT WINAPI BaseFilter_Destroy(BaseFilter * This)
+{
+    if (This->pClock)
+        IReferenceClock_Release(This->pClock);
+
+    This->IBaseFilter_iface.lpVtbl = NULL;
+    This->csFilter.DebugInfo->Spare[0] = 0;
+    DeleteCriticalSection(&This->csFilter);
+
+    return S_OK;
+}

Modified: trunk/reactos/lib/3rdparty/strmbase/renderer.c
URL:
http://svn.reactos.org/svn/reactos/trunk/reactos/lib/3rdparty/strmbase/rend…
==============================================================================
--- trunk/reactos/lib/3rdparty/strmbase/renderer.c	[iso-8859-1] (original)
+++ trunk/reactos/lib/3rdparty/strmbase/renderer.c	[iso-8859-1] Tue Jul 29 07:49:06 2014
@@ -284,7 +284,7 @@
 ULONG WINAPI BaseRendererImpl_Release(IBaseFilter* iface)
 {
     BaseRenderer *This = impl_from_IBaseFilter(iface);
-    ULONG refCount = BaseFilterImpl_Release(iface);
+    ULONG refCount = InterlockedDecrement(&This->filter.refCount);
 
     if (!refCount)
     {
@@ -309,6 +309,7 @@
         CloseHandle(This->ThreadSignal);
         CloseHandle(This->RenderEvent);
         QualityControlImpl_Destroy(This->qcimpl);
+        BaseFilter_Destroy(&This->filter);
     }
     return refCount;
 }

Modified: trunk/reactos/lib/3rdparty/strmbase/transform.c
URL:
http://svn.reactos.org/svn/reactos/trunk/reactos/lib/3rdparty/strmbase/tran…
==============================================================================
--- trunk/reactos/lib/3rdparty/strmbase/transform.c	[iso-8859-1] (original)
+++ trunk/reactos/lib/3rdparty/strmbase/transform.c	[iso-8859-1] Tue Jul 29 07:49:06 2014
@@ -295,7 +295,7 @@
 ULONG WINAPI TransformFilterImpl_Release(IBaseFilter * iface)
 {
     TransformFilter *This = impl_from_IBaseFilter(iface);
-    ULONG refCount = BaseFilterImpl_Release(iface);
+    ULONG refCount = InterlockedDecrement(&This->filter.refCount);
 
     TRACE("(%p/%p)->() Release from %d\n", This, iface, refCount + 1);
 
@@ -325,6 +325,7 @@
         FreeMediaType(&This->pmt);
         QualityControlImpl_Destroy(This->qcimpl);
         IUnknown_Release(This->seekthru_unk);
+        BaseFilter_Destroy(&This->filter);
         CoTaskMemFree(This);
 
         return 0;