[PATCH v20 1/3] rtworkq: Avoid use-after-free.

[Yuxuan Shui]

From: Yuxuan Shui

queue_release_pending_item releases the work_item reference but later accesses `item->queue`, which
is a potential use-after-free.
---
 dlls/rtworkq/queue.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/dlls/rtworkq/queue.c b/dlls/rtworkq/queue.c
index eebb096ad31..00b77bf6953 100644
--- a/dlls/rtworkq/queue.c
+++ b/dlls/rtworkq/queue.c
@@ -734,9 +734,10 @@ static HRESULT invoke_async_callback(IRtwqAsyncResult *result)
  * removed from pending items when it got canceled. */
 static BOOL queue_release_pending_item(struct work_item *item)
 {
+    struct queue *queue = item->queue;
     BOOL ret = FALSE;

-    EnterCriticalSection(&item->queue->cs);
+    EnterCriticalSection(&queue->cs);
     if (item->key)
     {
         list_remove(&item->entry);
@@ -744,7 +745,7 @@ static BOOL queue_release_pending_item(struct work_item *item)
         item->key = 0;
         IUnknown_Release(&item->IUnknown_iface);
     }
-    LeaveCriticalSection(&item->queue->cs);
+    LeaveCriticalSection(&queue->cs);
     return ret;
 }