[PATCH 0/1] MR10568: winegstreamer: Free the streams in unknown_inner_Release().

[Conor McCarthy (＠cmccarthy)]

IWMStreamConfig objects hold a pointer into the streams array, and
because they hold a reference on the reader's IWMProfile3 interface, the
streams array must be kept until the reader is released.

Wine-Bug: https://bugs.winehq.org/show_bug.cgi?id=59578

-- 
https://gitlab.winehq.org/wine/wine/-/merge_requests/10568

[PATCH 1/1] winegstreamer: Free the streams in unknown_inner_Release().

[Conor McCarthy]

From: Conor McCarthy <[e-mail]>

IWMStreamConfig objects hold a pointer into the streams array, and
because they hold a reference on the reader's IWMProfile3 interface, the
streams array must be kept until the reader is released.

Wine-Bug: https://bugs.winehq.org/show_bug.cgi?id=59578
---
 dlls/winegstreamer/wm_reader.c | 10 ++++------
 1 file changed, 4 insertions(+), 6 deletions(-)

diff --git a/dlls/winegstreamer/wm_reader.c b/dlls/winegstreamer/wm_reader.c
index 4f41f1a1ceb..6a800e4448c 100644
--- a/dlls/winegstreamer/wm_reader.c
+++ b/dlls/winegstreamer/wm_reader.c
@@ -1471,7 +1471,7 @@ static void free_stream_buffers(struct wm_reader *reader)
     }
 }
 
-static void free_streams(struct wm_reader *reader)
+static void release_stream_allocators(struct wm_reader *reader)
 {
     unsigned int i;
 
@@ -1486,9 +1486,6 @@ static void free_streams(struct wm_reader *reader)
             IWMReaderAllocatorEx_Release(stream->stream_allocator);
         stream->stream_allocator = NULL;
     }
-
-    free(reader->streams);
-    reader->streams = NULL;
 }
 
 static HRESULT init_stream(struct wm_reader *reader)
@@ -1688,7 +1685,7 @@ out_destroy_parser:
         reader->read_sem = NULL;
     }
     free_stream_buffers(reader);
-    free_streams(reader);
+    release_stream_allocators(reader);
     wg_parser_destroy(reader->wg_parser);
     reader->wg_parser = 0;
 
@@ -1917,6 +1914,7 @@ static ULONG WINAPI unknown_inner_Release(IUnknown *iface)
         reader->shutdown_cs.DebugInfo->Spare[0] = 0;
         DeleteCriticalSection(&reader->shutdown_cs);
 
+        free(reader->streams);
         free(reader);
     }
 
@@ -1970,7 +1968,7 @@ static HRESULT WINAPI reader_Close(IWMSyncReader2 *iface)
     ReleaseSemaphore(reader->read_sem, 1, NULL);
 
     free_stream_buffers(reader);
-    free_streams(reader);
+    release_stream_allocators(reader);
 
     wg_parser_disconnect(reader->wg_parser);
 
-- 
GitLab

https://gitlab.winehq.org/wine/wine/-/merge_requests/10568

[Elizabeth Figura (＠zfigura)]

This seems suspicious. What exactly is the application doing with the streams after calling Close()?

-- 
https://gitlab.winehq.org/wine/wine/-/merge_requests/10568#note_135601

[Conor McCarthy (＠cmccarthy)]

On Thu Apr  9 02:00:51 2026 +0000, Elizabeth Figura wrote:
> This seems suspicious. What exactly is the application doing with the
> streams after calling Close()?
> It releases the `IWMStreamConfig`, which releases the reader by accessing `config->stream->reader`. Another way to fix the bug is store a `reader` pointer in `struct stream_config` and use that instead.

-- 
https://gitlab.winehq.org/wine/wine/-/merge_requests/10568#note_135610

[Elizabeth Figura (＠zfigura)]

On Thu Apr  9 02:00:51 2026 +0000, Conor McCarthy wrote:
> It releases the `IWMStreamConfig`, which releases the reader by
> accessing `config->stream->reader`. Another way to fix the bug is store
> a `reader` pointer in `struct stream_config` and use that instead.
> Hrm. I guess this is fine for now.

-- 
https://gitlab.winehq.org/wine/wine/-/merge_requests/10568#note_136222

[PATCH 0/1] MR10568: winegstreamer: Free the streams in unknown_inner_Release(). - approved

[Elizabeth Figura (＠zfigura)]

This merge request was approved by Elizabeth Figura.
-- 
https://gitlab.winehq.org/wine/wine/-/merge_requests/10568