Re: [PATCH 0/1] MR3040: services: Fix use after free on error path in service_start (scan-build).

[Piotr Caban (＠piotr)]

Piotr Caban (@piotr) commented about programs/services/services.c:
>              service->status.dwCurrentState = SERVICE_STOPPED;
>              service->process = NULL;
>              if (!--process->use_count) process_terminate(process);
> -
>            release_process(process);

I don't see use after free error here. process_entry reference is stored in 2 places - in process variable and in service->process. Since The code is setting service->process to NULL it needs to decrease the reference counter. Later we're freeing process variable so another release_process call is needed.

I guess the tool doesn't know that process == service->process.