[Bug 36632] New: valgrind shows a use after free in dsound/tests/ds3d8.c

https://bugs.winehq.org/show_bug.cgi?id=36632

Bug ID: 36632
           Summary: valgrind shows a use after free in
                    dsound/tests/ds3d8.c
           Product: Wine
           Version: 1.7.19
          Hardware: x86
                OS: Linux
            Status: NEW
          Keywords: download, source, testcase
          Severity: normal
          Priority: P2
         Component: directx-dsound
          Assignee: [e-mail]
          Reporter: [e-mail]

../../../tools/runtest -q -P wine -T ../../.. -M dsound.dll -p
dsound_test.exe.so ds3d8 && touch ds3d8.ok
preloader: Warning: failed to reserve range 00110000-68000000
preloader: Warning: failed to reserve range 7f000000-82000000
==10296== Thread 2:
==10296== Invalid read of size 4
==10296==    at 0x7BC39D3F: RtlpWaitForCriticalSection (critsection.c:446)
==10296==    by 0x7BC3A0D0: RtlEnterCriticalSection (critsection.c:558)
==10296==    by 0x6315EBF: alsa_push_buffer_data (mmdevdrv.c:2150)
==10296==    by 0x7BC91871: timer_callback_wrapper (threadpool.c:572)
==10296==    by 0x7BC91BD4: queue_timer_expire (threadpool.c:649)
==10296==    by 0x7BC91DF5: timer_queue_thread_proc (threadpool.c:712)
==10296==    by 0x7BC87137: ??? (signal_i386.c:2571)
==10296==    by 0x7BC87180: call_thread_func (signal_i386.c:2630)
==10296==    by 0x7BC87115: ??? (signal_i386.c:2571)
==10296==    by 0x7BC8E560: start_thread (thread.c:428)
==10296==    by 0x4EA7BD89: start_thread (in /usr/lib/libpthread-2.18.so)
==10296==    by 0x4E95CA0D: clone (in /usr/lib/libc-2.18.so)
==10296==  Address 0x4908c54 is 300 bytes inside a block of size 344 free'd
==10296==    at 0x7BC4C7AA: notify_free (heap.c:263)
==10296==    by 0x7BC510EF: RtlFreeHeap (heap.c:1762)
==10296==    by 0x63113EE: AudioClient_Release (mmdevdrv.c:913)
==10296==    by 0x6319DAA: AudioStreamVolume_Release (audioclient.h:311)
==10296==    by 0x5D3F32A: DirectSoundDevice_Release (audioclient.h:1249)
==10296==    by 0x5D3D0E5: directsound_destroy (dsound.c:124)
==10296==    by 0x5D3D833: IDirectSound8Impl_Release (dsound.c:233)
==10296==    by 0x4A613E2: test_secondary8 (ds3d8.c:808)
==10296==    by 0x4A62955: dsenum_callback (ds3d8.c:1121)
==10296==    by 0x5D42693: a_to_w_callback (dsound_main.c:319)
==10296==    by 0x5D42F64: enumerate_mmdevices (dsound_main.c:492)
==10296==    by 0x5D43278: DirectSoundEnumerateW (dsound_main.c:561)
==10296==    by 0x5D42736: DirectSoundEnumerateA (dsound_main.c:349)
==10296==    by 0x4A62BC4: ds3d8_tests (ds3d8.c:1137)
==10296==    by 0x4A62CC0: func_ds3d8 (ds3d8.c:1157)
==10296==    by 0x4A74540: run_test (test.h:584)
==10296==    by 0x4A7492F: main (test.h:654)
==10296==