[PATCH 1/1] mf: Avoid a double free of presentation clock timers.

[Zhiyi Zhang]

From: Zhiyi Zhang

In clock_change_state() when a clock is running, a timer is removed from clock->timers. The same
timer is then used to create an async result, which will eventually calls present_clock_timer_callback_Invoke()
and removes the same timer.
---
 dlls/mf/clock.c | 2 --
 1 file changed, 2 deletions(-)

diff --git a/dlls/mf/clock.c b/dlls/mf/clock.c
index aef4366c6d9..ca9937d90dd 100644
--- a/dlls/mf/clock.c
+++ b/dlls/mf/clock.c
@@ -623,9 +623,7 @@ static HRESULT clock_change_state(struct presentation_clock *clock, enum clock_c
         {
             LIST_FOR_EACH_ENTRY_SAFE(timer, timer2, &clock->timers, struct clock_timer, entry)
             {
-                list_remove(&timer->entry);
                 hr = MFCreateAsyncResult(&timer->IUnknown_iface, &clock->timer_callback, NULL, &result);
-                IUnknown_Release(&timer->IUnknown_iface);
                 if (SUCCEEDED(hr))
                 {
                     MFPutWorkItemEx(MFASYNC_CALLBACK_QUEUE_TIMER, result);