The stream sample allocator callback NotifyRelease() method assumes that the source reader is valid. Therefore it must own a reference to it, otherwise it might get called while the source reader is being destroyed, causing a crash.
Signed-off-by: Giovanni Mascellani gmascellani@codeweavers.com --- dlls/mfreadwrite/reader.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/dlls/mfreadwrite/reader.c b/dlls/mfreadwrite/reader.c index bdf2e7f5a6f..2d3da19db10 100644 --- a/dlls/mfreadwrite/reader.c +++ b/dlls/mfreadwrite/reader.c @@ -2282,12 +2282,14 @@ static HRESULT WINAPI stream_sample_allocator_cb_QueryInterface(IMFVideoSampleAl
static ULONG WINAPI stream_sample_allocator_cb_AddRef(IMFVideoSampleAllocatorNotify *iface) { - return 2; + struct media_stream *stream = impl_stream_from_IMFVideoSampleAllocatorNotify(iface); + return source_reader_addref(stream->reader); }
static ULONG WINAPI stream_sample_allocator_cb_Release(IMFVideoSampleAllocatorNotify *iface) { - return 1; + struct media_stream *stream = impl_stream_from_IMFVideoSampleAllocatorNotify(iface); + return source_reader_release(stream->reader); }
static HRESULT WINAPI stream_sample_allocator_cb_NotifyRelease(IMFVideoSampleAllocatorNotify *iface)