From: Yuxuan Shui yshui@codeweavers.com
In kernel32/tests/loader.c, child_process will try to write to stdout after calling LdrShutdownProcess. LdrShutdownProcess calls DLL_PROCESS_DETACH on msvcrt, which calls msvcrt_free_io, which frees the ioinfo blocks. So to prevent use after free in this case, we don't free them during shutdown. --- dlls/msvcrt/file.c | 1 - dlls/msvcrt/main.c | 3 ++- 2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/dlls/msvcrt/file.c b/dlls/msvcrt/file.c index 90d3d59c744..01853625c23 100644 --- a/dlls/msvcrt/file.c +++ b/dlls/msvcrt/file.c @@ -1394,7 +1394,6 @@ void msvcrt_free_io(void) unsigned int i; int j;
- _flushall(); _fcloseall();
for(i=0; i<ARRAY_SIZE(MSVCRT___pioinfo); i++) diff --git a/dlls/msvcrt/main.c b/dlls/msvcrt/main.c index e4bcfe35681..39c20b20241 100644 --- a/dlls/msvcrt/main.c +++ b/dlls/msvcrt/main.c @@ -142,8 +142,9 @@ BOOL WINAPI DllMain(HINSTANCE hinstDLL, DWORD fdwReason, LPVOID lpvReserved) #endif break; case DLL_PROCESS_DETACH: - msvcrt_free_io(); + _flushall(); if (lpvReserved) break; + msvcrt_free_io(); msvcrt_free_popen_data(); msvcrt_free_locks(); msvcrt_free_console();