[PATCH v2 1/1] oleaut32: Lock ITypeLib2 interface reference count behind the typelib cache critical section.

[Connor McAdams]

From: Connor McAdams

This prevents an ITypeLib2 interface being returned from the typelib
cache that is in the middle of being destroyed.

Signed-off-by: Connor McAdams 
---
 dlls/oleaut32/typelib.c | 15 ++++++++++-----
 1 file changed, 10 insertions(+), 5 deletions(-)

diff --git a/dlls/oleaut32/typelib.c b/dlls/oleaut32/typelib.c
index fa512184182..cd79d71ff19 100644
--- a/dlls/oleaut32/typelib.c
+++ b/dlls/oleaut32/typelib.c
@@ -4702,7 +4702,11 @@ static HRESULT WINAPI ITypeLib2_fnQueryInterface(ITypeLib2 *iface, REFIID riid,
 static ULONG WINAPI ITypeLib2_fnAddRef( ITypeLib2 *iface)
 {
     ITypeLibImpl *This = impl_from_ITypeLib2(iface);
-    ULONG ref = InterlockedIncrement(&This->ref);
+    ULONG ref;
+
+    EnterCriticalSection(&cache_section);
+    ref = ++This->ref;
+    LeaveCriticalSection(&cache_section);

TRACE("%p, refcount %lu.\n", iface, ref);

@@ -4712,7 +4716,10 @@ static ULONG WINAPI ITypeLib2_fnAddRef( ITypeLib2 *iface)
 static ULONG WINAPI ITypeLib2_fnRelease( ITypeLib2 *iface)
 {
     ITypeLibImpl *This = impl_from_ITypeLib2(iface);
-    ULONG ref = InterlockedDecrement(&This->ref);
+    ULONG ref;
+
+    EnterCriticalSection(&cache_section);
+    ref = --This->ref;

TRACE("%p, refcount %lu.\n", iface, ref);

@@ -4728,10 +4735,8 @@ static ULONG WINAPI ITypeLib2_fnRelease( ITypeLib2 *iface)
       if(This->path)
       {
           TRACE("removing from cache list\n");
-          EnterCriticalSection(&cache_section);
           if(This->entry.next)
               list_remove(&This->entry);
-          LeaveCriticalSection(&cache_section);
           free(This->path);
       }
       TRACE(" destroying ITypeLib(%p)\n",This);
@@ -4783,9 +4788,9 @@ static ULONG WINAPI ITypeLib2_fnRelease( ITypeLib2 *iface)
       }
       free(This->typeinfos);
       free(This);
-      return 0;
     }

+    LeaveCriticalSection(&cache_section);
     return ref;
 }