Stefan Dösinger : wined3d: Avoid reading freed memory when destroying shader resource views.

[Alexandre Julliard]

Module: wine
Branch: master
Commit: 80348ec5b47dd0de18105fc50e0cf940601bfdda
URL:    http://source.winehq.org/git/wine.git/?a=commit;h=80348ec5b47dd0de18105fc50e...

Author: Stefan Dösinger <stefandoesinger(a)gmx.at>
Date:   Sun Jul  3 16:49:33 2016 +0100

wined3d: Avoid reading freed memory when destroying shader resource views.

Signed-off-by: Stefan Dösinger <stefandoesinger(a)gmx.at>
Signed-off-by: Henri Verbeet <hverbeet(a)codeweavers.com>
Signed-off-by: Alexandre Julliard <julliard(a)winehq.org>

---

 dlls/wined3d/view.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/dlls/wined3d/view.c b/dlls/wined3d/view.c
index e39f6f8..5318a5d 100644
--- a/dlls/wined3d/view.c
+++ b/dlls/wined3d/view.c
@@ -228,13 +228,14 @@ ULONG CDECL wined3d_shader_resource_view_decref(struct wined3d_shader_resource_v
 
     if (!refcount)
     {
-        struct wined3d_device *device = view->resource->device;
+        struct wined3d_resource *resource = view->resource;
+        struct wined3d_device *device = resource->device;
 
         /* Call wined3d_object_destroyed() before releasing the resource,
          * since releasing the resource may end up destroying the parent. */
         view->parent_ops->wined3d_object_destroyed(view->parent);
-        wined3d_resource_decref(view->resource);
         wined3d_cs_emit_destroy_object(device->cs, wined3d_shader_resource_view_destroy_object, view);
+        wined3d_resource_decref(resource);
     }
 
     return refcount;