[Bug 46270] New: STGMEDIUM_UserFree unconditional releases a HGLOBAL

https://bugs.winehq.org/show_bug.cgi?id=46270

Bug ID: 46270
           Summary: STGMEDIUM_UserFree unconditional releases a HGLOBAL
           Product: Wine
           Version: unspecified
          Hardware: x86
                OS: Linux
            Status: UNCONFIRMED
          Severity: normal
          Priority: P2
         Component: ole32
          Assignee: [e-mail]
          Reporter: [e-mail]
      Distribution: ---

Created attachment 62980
  --> https://bugs.winehq.org/attachment.cgi?id=62980
ReactOS +ole capture

When an STGMEDIUM is marshalled locally (just copied),
the HGLOBAL is actually deleted by the stub.
This leaves the recipient of the STGMEDIUM with a head object.

Before 5293cb71838bba86961f62e2317f532c9812db0c this was not a problem, because
an HGLOBAL was always treated as 'remote'.

Thanks to Zebediah Figura for figuring out the problem based on my very
incomplete description :)

[Bug 46270] STGMEDIUM_UserFree unconditional releases a HGLOBAL

https://bugs.winehq.org/show_bug.cgi?id=46270

Mark Jansen  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
                 OS|Linux                       |other

[Bug 46270] ReactOS explorer.exe can't delete objects ( use-after free caused by incorrect free in STGMEDIUM_Release())

https://bugs.winehq.org/show_bug.cgi?id=46270

Zebediah Figura  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
           Keywords|                            |regression
    Regression SHA1|                            |5293cb71838bba86961f62e2317
                   |                            |f532c9812db0c
            Summary|STGMEDIUM_UserFree          |ReactOS explorer.exe can't
                   |unconditional releases a    |delete objects (use-after
                   |HGLOBAL                     |free caused by incorrect
                   |                            |free in
                   |                            |STGMEDIUM_Release())
                 CC|                            |[e-mail]

[Bug 46270] ReactOS explorer.exe can't delete objects ( use-after free caused by incorrect free in STGMEDIUM_Release())

https://bugs.winehq.org/show_bug.cgi?id=46270

Nikolay Sivov  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
            Version|unspecified                 |4.0-rc1

[Bug 46270] ReactOS explorer.exe can't delete objects ( use-after free caused by incorrect free in STGMEDIUM_Release())

https://bugs.winehq.org/show_bug.cgi?id=46270

Zebediah Figura  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |RESOLVED
         Resolution|---                         |FIXED
      Fixed by SHA1|                            |25b136d40080a80c006b89e0270
                   |                            |8d2e248504a42

--- Comment #1 from Zebediah Figura  ---
This should be fixed by
https://source.winehq.org/git/wine.git/commitdiff/25b136d40080a80c006b89e027....

[Bug 46270] ReactOS explorer.exe can't delete objects ( use-after free caused by incorrect free in STGMEDIUM_Release())

https://bugs.winehq.org/show_bug.cgi?id=46270

Alexandre Julliard  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|RESOLVED                    |CLOSED

--- Comment #2 from Alexandre Julliard  ---
Closing bugs fixed in 4.0-rc2.