[PATCH v3 1/1] oleaut32: Lock ITypeLib2 interface reference count behind the typelib cache critical section on Release.

[Connor McAdams]

From: Connor McAdams

This prevents an ITypeLib2 interface being returned from the typelib
cache that is in the middle of being destroyed.

Signed-off-by: Connor McAdams 
---
 dlls/oleaut32/typelib.c | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/dlls/oleaut32/typelib.c b/dlls/oleaut32/typelib.c
index fa512184182..1ff84aaa5fb 100644
--- a/dlls/oleaut32/typelib.c
+++ b/dlls/oleaut32/typelib.c
@@ -4712,7 +4712,10 @@ static ULONG WINAPI ITypeLib2_fnAddRef( ITypeLib2 *iface)
 static ULONG WINAPI ITypeLib2_fnRelease( ITypeLib2 *iface)
 {
     ITypeLibImpl *This = impl_from_ITypeLib2(iface);
-    ULONG ref = InterlockedDecrement(&This->ref);
+    ULONG ref;
+
+    EnterCriticalSection(&cache_section);
+    ref = InterlockedDecrement(&This->ref);

TRACE("%p, refcount %lu.\n", iface, ref);

@@ -4728,10 +4731,8 @@ static ULONG WINAPI ITypeLib2_fnRelease( ITypeLib2 *iface)
       if(This->path)
       {
           TRACE("removing from cache list\n");
-          EnterCriticalSection(&cache_section);
           if(This->entry.next)
               list_remove(&This->entry);
-          LeaveCriticalSection(&cache_section);
           free(This->path);
       }
       TRACE(" destroying ITypeLib(%p)\n",This);
@@ -4783,9 +4784,9 @@ static ULONG WINAPI ITypeLib2_fnRelease( ITypeLib2 *iface)
       }
       free(This->typeinfos);
       free(This);
-      return 0;
     }

+    LeaveCriticalSection(&cache_section);
     return ref;
 }