Connor McAdams : oleaut32: Lock ITypeLib2 interface reference count behind the typelib cache critical section on Release.

[Alexandre Julliard]

Module: wine
Branch: master
Commit: 3e84b49305930fc74705e2e417851de20489ece8
URL:    https://gitlab.winehq.org/wine/wine/-/commit/3e84b49305930fc74705e2e417851de...

Author: Connor McAdams 
Date:   Wed Nov  8 08:15:19 2023 -0500

oleaut32: Lock ITypeLib2 interface reference count behind the typelib cache critical section on Release.

This prevents an ITypeLib2 interface being returned from the typelib
cache that is in the middle of being destroyed.

Signed-off-by: Connor McAdams

---

dlls/oleaut32/typelib.c | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/dlls/oleaut32/typelib.c b/dlls/oleaut32/typelib.c
index fa512184182..1ff84aaa5fb 100644
--- a/dlls/oleaut32/typelib.c
+++ b/dlls/oleaut32/typelib.c
@@ -4712,7 +4712,10 @@ static ULONG WINAPI ITypeLib2_fnAddRef( ITypeLib2 *iface)
 static ULONG WINAPI ITypeLib2_fnRelease( ITypeLib2 *iface)
 {
     ITypeLibImpl *This = impl_from_ITypeLib2(iface);
-    ULONG ref = InterlockedDecrement(&This->ref);
+    ULONG ref;
+
+    EnterCriticalSection(&cache_section);
+    ref = InterlockedDecrement(&This->ref);

TRACE("%p, refcount %lu.\n", iface, ref);

@@ -4728,10 +4731,8 @@ static ULONG WINAPI ITypeLib2_fnRelease( ITypeLib2 *iface)
       if(This->path)
       {
           TRACE("removing from cache list\n");
-          EnterCriticalSection(&cache_section);
           if(This->entry.next)
               list_remove(&This->entry);
-          LeaveCriticalSection(&cache_section);
           free(This->path);
       }
       TRACE(" destroying ITypeLib(%p)\n",This);
@@ -4783,9 +4784,9 @@ static ULONG WINAPI ITypeLib2_fnRelease( ITypeLib2 *iface)
       }
       free(This->typeinfos);
       free(This);
-      return 0;
     }

+    LeaveCriticalSection(&cache_section);
     return ref;
 }