Huw Davies : rpcrt4: Don't free the argument if the freer was called, unless it's a simple ref.

[Alexandre Julliard]

Module: wine
Branch: master
Commit: b2667416c21e0e9e829169404be4c04b4c973139
URL:    http://source.winehq.org/git/wine.git/?a=commit;h=b2667416c21e0e9e829169404b...

Author: Huw Davies <huw(a)codeweavers.com>
Date:   Wed Nov  8 11:19:56 2017 +0000

rpcrt4: Don't free the argument if the freer was called, unless it's a simple ref.

In the simple reference case the freer will not see the top-level
pointer, so we need to free that here.

This fixes a double-free caused by commit 614afcefa33c727f31d566c3d7ee05d74afc363f.

Signed-off-by: Huw Davies <huw(a)codeweavers.com>
Signed-off-by: Alexandre Julliard <julliard(a)winehq.org>

---

 dlls/rpcrt4/ndr_stubless.c | 17 ++++++++---------
 1 file changed, 8 insertions(+), 9 deletions(-)

diff --git a/dlls/rpcrt4/ndr_stubless.c b/dlls/rpcrt4/ndr_stubless.c
index f65eaf5..f84c617 100644
--- a/dlls/rpcrt4/ndr_stubless.c
+++ b/dlls/rpcrt4/ndr_stubless.c
@@ -1137,6 +1137,11 @@ LONG_PTR __cdecl call_server_func(SERVER_ROUTINE func, unsigned char * args, uns
 }
 #endif
 
+static inline BOOL param_needs_alloc( PARAM_ATTRIBUTES attr )
+{
+    return attr.IsOut && !attr.IsIn && !attr.IsBasetype && !attr.IsByValue;
+}
+
 static LONG_PTR *stub_do_args(MIDL_STUB_MESSAGE *pStubMsg,
                               PFORMAT_STRING pFormat, enum stubless_phase phase,
                               unsigned short number_of_params)
@@ -1172,20 +1177,14 @@ static LONG_PTR *stub_do_args(MIDL_STUB_MESSAGE *pStubMsg,
             {
                 HeapFree(GetProcessHeap(), 0, *(void **)pArg);
             }
-            else if (params[i].attr.IsOut &&
-                     !params[i].attr.IsIn &&
-                     !params[i].attr.IsBasetype &&
-                     !params[i].attr.IsByValue)
+            else if (param_needs_alloc(params[i].attr) &&
+                     (!params[i].attr.MustFree || params[i].attr.IsSimpleRef))
             {
                 if (*pTypeFormat != RPC_FC_BIND_CONTEXT) pStubMsg->pfnFree(*(void **)pArg);
             }
             break;
         case STUBLESS_INITOUT:
-            if (!params[i].attr.IsIn &&
-                params[i].attr.IsOut &&
-                !params[i].attr.IsBasetype &&
-                !params[i].attr.ServerAllocSize &&
-                !params[i].attr.IsByValue)
+            if (param_needs_alloc(params[i].attr) && !params[i].attr.ServerAllocSize)
             {
                 if (*pTypeFormat == RPC_FC_BIND_CONTEXT)
                 {