Commit e4cdcb1e authored by Zhiyi Zhang's avatar Zhiyi Zhang Committed by Alexandre Julliard

mf: Avoid a double free of presentation clock timers.

In clock_change_state() when a clock is running, a timer is removed from clock->timers. The same timer is then used to create an async result, which will eventually calls present_clock_timer_callback_Invoke() and release the same timer. Check if the timer is still in clock->timers before releasing it.
parent 8f282944
...@@ -1108,13 +1108,19 @@ static HRESULT WINAPI present_clock_timer_callback_Invoke(IMFAsyncCallback *ifac ...@@ -1108,13 +1108,19 @@ static HRESULT WINAPI present_clock_timer_callback_Invoke(IMFAsyncCallback *ifac
if (FAILED(hr = IMFAsyncResult_GetObject(result, &object))) if (FAILED(hr = IMFAsyncResult_GetObject(result, &object)))
return hr; return hr;
timer = impl_clock_timer_from_IUnknown(object);
EnterCriticalSection(&clock->cs); EnterCriticalSection(&clock->cs);
list_remove(&timer->entry); LIST_FOR_EACH_ENTRY(timer, &clock->timers, struct clock_timer, entry)
IUnknown_Release(&timer->IUnknown_iface); {
if (&timer->IUnknown_iface == object)
{
list_remove(&timer->entry);
IUnknown_Release(&timer->IUnknown_iface);
break;
}
}
LeaveCriticalSection(&clock->cs); LeaveCriticalSection(&clock->cs);
timer = impl_clock_timer_from_IUnknown(object);
IMFAsyncCallback_Invoke(timer->callback, timer->result); IMFAsyncCallback_Invoke(timer->callback, timer->result);
IUnknown_Release(object); IUnknown_Release(object);
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment