Module: wine Branch: master Commit: 1113f42aa748d9e0a27c4663b9d8de1237f95e73 URL: https://gitlab.winehq.org/wine/wine/-/commit/1113f42aa748d9e0a27c4663b9d8de1...
Author: Brendan McGrath brendan@redmandi.com Date: Sun Jul 17 12:38:09 2022 +1000
qedit: Do not force the sample to be freed in SampleGrabber_callback().
Remove a work around that causes a crash in Unravel Two.
There is a callback in Unravel Two that appears to add a reference to a IMediaSample, which this workaround treats as a leak and releases. However, the application also later releases the reference itself, causing a use-after-free.
Wine-Bug: https://bugs.winehq.org/show_bug.cgi?id=51616 Signed-off-by: Brendan McGrath brendan@redmandi.com Signed-off-by: Zebediah Figura zfigura@codeweavers.com Signed-off-by: Alexandre Julliard julliard@winehq.org
---
dlls/qedit/samplegrabber.c | 3 --- dlls/qedit/tests/mediadet.c | 2 +- 2 files changed, 1 insertion(+), 4 deletions(-)
diff --git a/dlls/qedit/samplegrabber.c b/dlls/qedit/samplegrabber.c index 9b9780e564a..cefb2f37078 100644 --- a/dlls/qedit/samplegrabber.c +++ b/dlls/qedit/samplegrabber.c @@ -164,9 +164,6 @@ static void SampleGrabber_callback(struct sample_grabber *This, IMediaSample *sa if (ref) { ERR("(%p) Callback referenced sample %p by %lu\n", This, sample, ref); - /* ugly as hell but some apps are sooo buggy */ - while (ref--) - IMediaSample_Release(sample); } } break; diff --git a/dlls/qedit/tests/mediadet.c b/dlls/qedit/tests/mediadet.c index 6e7017f865c..05805c56eb5 100644 --- a/dlls/qedit/tests/mediadet.c +++ b/dlls/qedit/tests/mediadet.c @@ -1094,7 +1094,7 @@ static void test_samplegrabber(void) ok(samplecb_called == TRUE, "SampleCB should have been called\n");
refcount = IUnknown_Release(&my_sample.sample); - todo_wine ok(!refcount, "Got unexpected refcount %ld.\n", refcount); + ok(!refcount, "Got unexpected refcount %ld.\n", refcount);
IMemInputPin_Release(inpin); IPin_Release(pin);