[Bug 54609] 32-bit Softerra LDAP Administrator crashes due to proxy use-after-free

[WineHQ Bugzilla]

https://bugs.winehq.org/show_bug.cgi?id=54609

Zeb Figura  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
           Keywords|                            |download
            Summary|32-bit LDAP Administrator   |32-bit Softerra LDAP
                   |crashes in internal Wine    |Administrator crashes due
                   |function                    |to proxy use-after-free
                   |proxy_manager_destroy       |
                 CC|                            |[e-mail]
                URL|                            |https://softerra-downloads.
                   |                            |com/ldapadmin/ldapadmin-4.2
                   |                            |1.24429.0-x86-eng.msi

--- Comment #1 from Zeb Figura  ---
As far as I can tell the remoted method is doing something like the following:

HRESULT remote_Method(IScpMTAMarshaller *this, [in] IUnknown *unk, [out] int64
*ptr)
{
    *ptr = (int64)unk;
    return S_OK;
}

Which, yes, can't possibly work.

There are a few possibilities that occur to me:

* the IUnknown isn't actually supposed to be proxied (i.e. it's supposed to be
passed directly). Seems unlikely though given that 0100 (the calling thread) is
an STA. Though it's odd that 0110 (the stub thread) never has COM initialized,
and I'm not sure why it's hosting objects in the first place?

* Windows zeroes the vtbl or something after destroying a proxy, and then the
resulting exception is caught by the COM RPC exception handler.