[PATCH 0/1] MR10097: winegstreamer: Use a single call to free the streams array (ASan).

[Bernhard Übelacker]

The last run with ASan shows the report below. If I understand it right in `init_stream` the streams array gets allocated in a [single call to calloc](https://gitlab.winehq.org/wine/wine/-/blob/964cd76c020dfb8c72dea0b005d6795ab...). But in the [current version](https://gitlab.winehq.org/wine/wine/-/blob/964cd76c020dfb8c72dea0b005d6795ab...) of `free_streams` individual elements of the array get freed, which in the first iterations seems to free the whole array. Therefore ASan gets triggered when accessing the second element of the array.

Followup of 964cd76c.

CC: @cmccarthy 

<details>
<summary>ASan details [gitlab run](https://gitlab.winehq.org/bernhardu/wine/-/jobs/228543#L4644)</summary>

```
=================================================================
==qasf_test.exe==1008==ERROR: AddressSanitizer: heap-use-after-free on address 0x02202f34 at pc 0x782389d4 bp 0x0022f8d4 sp 0x0022f8d0
READ of size 4 at 0x02202f34 thread T0
    #0 0x782389d3 in free_streams /builds/bernhardu/wine/build64/../dlls/winegstreamer/wm_reader.c:1482:21
    #1 0x78233c59 in reader_Close /builds/bernhardu/wine/build64/../dlls/winegstreamer/wm_reader.c:1972:5
    #2 0x7844399c in IWMSyncReader2_Close /builds/bernhardu/wine/build64/include/wmsdkidl.h:7313:12
    #3 0x78442b85 in WMReader_Release /builds/bernhardu/wine/build64/../dlls/wmvcore/async_reader.c:586:9
    #4 0x784c140c in IWMReader_Release /builds/bernhardu/wine/build64/include/wmsdkidl.h:3767:12
    #5 0x784c57a0 in asf_reader_destroy /builds/bernhardu/wine/build64/../dlls/qasf/asfreader.c:449:5
    #6 0x784d1a32 in filter_inner_Release /builds/bernhardu/wine/build64/../libs/strmbase/filter.c:259:9
    #7 0x784ce484 in filter_Release /builds/bernhardu/wine/build64/../libs/strmbase/filter.c:291:12
    #8 0x784c6f1c in IBaseFilter_Release /builds/bernhardu/wine/build64/include/strmif.h:2053:12
    #9 0x784c68d3 in file_source_Release /builds/bernhardu/wine/build64/../dlls/qasf/asfreader.c:659:12
    #10 0x004077cc in IFileSourceFilter_Release /builds/bernhardu/wine/build64/include/strmif.h:5555:12
    #11 0x00402df8 in test_filesourcefilter /builds/bernhardu/wine/build64/../dlls/qasf/tests/asfreader.c:503:11
    #12 0x0040102d in func_asfreader /builds/bernhardu/wine/build64/../dlls/qasf/tests/asfreader.c:1119:5
    #13 0x0041d791 in run_test /builds/bernhardu/wine/build64/../include/wine/test.h:780:5
    #14 0x0041d24a in main /builds/bernhardu/wine/build64/../include/wine/test.h:900:12
    #15 0x0042c2b5 in mainCRTStartup /builds/bernhardu/wine/build64/../dlls/msvcrt/crt_main.c:62:11
    #16 0x7bcd367f in BaseThreadInitThunk (C:\windows\system32\kernel32.dll+0x7b82367f)
    #17 0x7be4678a in call_thread_func_wrapper (C:\windows\system32\ntdll.dll+0x7bc4678a)
    #18 0x7be470fa in call_thread_func /builds/bernhardu/wine/build64/../dlls/ntdll/signal_i386.c:503:9
0x02202f34 is located 372 bytes inside of 384-byte region [0x02202dc0,0x02202f40)
freed by thread T0 here:
    #0 0x785f5e10 in HeapFree /home/runner/work/llvm-mingw/llvm-mingw/llvm-project/compiler-rt/lib/asan/asan_malloc_win.cpp:254:3
    #1 0x79ddefd5 in msvcrt_heap_free /builds/bernhardu/wine/build64/../dlls/msvcrt/heap.c
    #2 0x79ddf5ec in free /builds/bernhardu/wine/build64/../dlls/msvcrt/heap.c:414:3
    #3 0x7823890b in free_streams /builds/bernhardu/wine/build64/../dlls/winegstreamer/wm_reader.c:1489:9
    #4 0x78233c59 in reader_Close /builds/bernhardu/wine/build64/../dlls/winegstreamer/wm_reader.c:1972:5
    #5 0x7844399c in IWMSyncReader2_Close /builds/bernhardu/wine/build64/include/wmsdkidl.h:7313:12
    #6 0x78442b85 in WMReader_Release /builds/bernhardu/wine/build64/../dlls/wmvcore/async_reader.c:586:9
    #7 0x784c140c in IWMReader_Release /builds/bernhardu/wine/build64/include/wmsdkidl.h:3767:12
    #8 0x784c57a0 in asf_reader_destroy /builds/bernhardu/wine/build64/../dlls/qasf/asfreader.c:449:5
    #9 0x784d1a32 in filter_inner_Release /builds/bernhardu/wine/build64/../libs/strmbase/filter.c:259:9
    #10 0x784ce484 in filter_Release /builds/bernhardu/wine/build64/../libs/strmbase/filter.c:291:12
    #11 0x784c6f1c in IBaseFilter_Release /builds/bernhardu/wine/build64/include/strmif.h:2053:12
    #12 0x784c68d3 in file_source_Release /builds/bernhardu/wine/build64/../dlls/qasf/asfreader.c:659:12
    #13 0x004077cc in IFileSourceFilter_Release /builds/bernhardu/wine/build64/include/strmif.h:5555:12
    #14 0x00402df8 in test_filesourcefilter /builds/bernhardu/wine/build64/../dlls/qasf/tests/asfreader.c:503:11
    #15 0x0040102d in func_asfreader /builds/bernhardu/wine/build64/../dlls/qasf/tests/asfreader.c:1119:5
    #16 0x0041d791 in run_test /builds/bernhardu/wine/build64/../include/wine/test.h:780:5
    #17 0x0041d24a in main /builds/bernhardu/wine/build64/../include/wine/test.h:900:12
    #18 0x0042c2b5 in mainCRTStartup /builds/bernhardu/wine/build64/../dlls/msvcrt/crt_main.c:62:11
    #19 0x7bcd367f in BaseThreadInitThunk (C:\windows\system32\kernel32.dll+0x7b82367f)
    #20 0x7be4678a in call_thread_func_wrapper (C:\windows\system32\ntdll.dll+0x7bc4678a)
    #21 0x7be470fa in call_thread_func /builds/bernhardu/wine/build64/../dlls/ntdll/signal_i386.c:503:9
previously allocated by thread T0 here:
    #0 0x785f5c96 in HeapAlloc /home/runner/work/llvm-mingw/llvm-mingw/llvm-project/compiler-rt/lib/asan/asan_malloc_win.cpp:230:3
    #1 0x79ddeedc in msvcrt_heap_alloc /builds/bernhardu/wine/build64/../dlls/msvcrt/heap.c:71:12
    #2 0x79ddf5d2 in calloc /builds/bernhardu/wine/build64/../dlls/msvcrt/heap.c:396:10
    #3 0x78236e13 in init_stream /builds/bernhardu/wine/build64/../dlls/winegstreamer/wm_reader.c:1525:29
    #4 0x78233a38 in reader_Open /builds/bernhardu/wine/build64/../dlls/winegstreamer/wm_reader.c:2351:21
    #5 0x78443bef in IWMSyncReader2_Open /builds/bernhardu/wine/build64/include/wmsdkidl.h:7310:12
    #6 0x78442d68 in WMReader_Open /builds/bernhardu/wine/build64/../dlls/wmvcore/async_reader.c:606:24
    #7 0x784c6fc4 in IWMReader_Open /builds/bernhardu/wine/build64/include/wmsdkidl.h:3771:12
    #8 0x784c6a2b in file_source_Load /builds/bernhardu/wine/build64/../dlls/qasf/asfreader.c:682:24
    #9 0x004073d2 in IFileSourceFilter_Load /builds/bernhardu/wine/build64/include/strmif.h:5559:12
    #10 0x00402aa3 in test_filesourcefilter /builds/bernhardu/wine/build64/../dlls/qasf/tests/asfreader.c:466:10
    #11 0x0040102d in func_asfreader /builds/bernhardu/wine/build64/../dlls/qasf/tests/asfreader.c:1119:5
    #12 0x0041d791 in run_test /builds/bernhardu/wine/build64/../include/wine/test.h:780:5
    #13 0x0041d24a in main /builds/bernhardu/wine/build64/../include/wine/test.h:900:12
    #14 0x0042c2b5 in mainCRTStartup /builds/bernhardu/wine/build64/../dlls/msvcrt/crt_main.c:62:11
    #15 0x7bcd367f in BaseThreadInitThunk (C:\windows\system32\kernel32.dll+0x7b82367f)
    #16 0x7be4678a in call_thread_func_wrapper (C:\windows\system32\ntdll.dll+0x7bc4678a)
    #17 0x7be470fa in call_thread_func /builds/bernhardu/wine/build64/../dlls/ntdll/signal_i386.c:503:9
SUMMARY: AddressSanitizer: heap-use-after-free /builds/bernhardu/wine/build64/../dlls/winegstreamer/wm_reader.c:1482:21 in free_streams
```
</details>

-- 
https://gitlab.winehq.org/wine/wine/-/merge_requests/10097

[PATCH 1/1] winegstreamer: Use a single call to free the streams array (ASan).

[Bernhard Übelacker]

From: Bernhard Übelacker <[e-mail]>

Followup of 964cd76c.
---
 dlls/winegstreamer/wm_reader.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/dlls/winegstreamer/wm_reader.c b/dlls/winegstreamer/wm_reader.c
index 26fed0990ca..4f41f1a1ceb 100644
--- a/dlls/winegstreamer/wm_reader.c
+++ b/dlls/winegstreamer/wm_reader.c
@@ -1485,9 +1485,10 @@ static void free_streams(struct wm_reader *reader)
         if (stream->stream_allocator)
             IWMReaderAllocatorEx_Release(stream->stream_allocator);
         stream->stream_allocator = NULL;
-
-        free(stream);
     }
+
+    free(reader->streams);
+    reader->streams = NULL;
 }
 
 static HRESULT init_stream(struct wm_reader *reader)
-- 
GitLab

https://gitlab.winehq.org/wine/wine/-/merge_requests/10097

[PATCH 0/1] MR10097: winegstreamer: Use a single call to free the streams array (ASan). - approved

[Conor McCarthy (＠cmccarthy)]

This merge request was approved by Conor McCarthy.
-- 
https://gitlab.winehq.org/wine/wine/-/merge_requests/10097

[PATCH 0/1] MR10097: winegstreamer: Use a single call to free the streams array (ASan). - approved

[Elizabeth Figura (＠zfigura)]

This merge request was approved by Elizabeth Figura.
-- 
https://gitlab.winehq.org/wine/wine/-/merge_requests/10097