[PATCH 0/1] MR7090: uiautomationcore: Fix a double-free of advisers array (ASan).

[Nikolay Sivov (＠nsivov)]

Signed-off-by: Nikolay Sivov

[PATCH 1/1] uiautomationcore: Fix a double-free of advisers array (ASan).

[Bernhard Übelacker]

From: Bernhard Übelacker

Signed-off-by: Nikolay Sivov 
---
 dlls/uiautomationcore/uia_event.c | 22 +++++++++++++---------
 1 file changed, 13 insertions(+), 9 deletions(-)

diff --git a/dlls/uiautomationcore/uia_event.c b/dlls/uiautomationcore/uia_event.c
index 0106be09999..4538840f16b 100644
--- a/dlls/uiautomationcore/uia_event.c
+++ b/dlls/uiautomationcore/uia_event.c
@@ -993,6 +993,17 @@ BOOL uia_clientside_event_start_event_thread(struct uia_event *event)
     return event->u.clientside.event_thread_started;
 }

+static void uia_event_clear_advisers(struct uia_event *event)
+{
+    int i;
+
+    for (i = 0; i < event->event_advisers_count; i++)
+        IWineUiaEventAdviser_Release(event->event_advisers[i]);
+    free(event->event_advisers);
+    event->event_advisers = NULL;
+    event->event_advisers_count = event->event_advisers_arr_size = 0;
+}
+
 /*
  * IWineUiaEvent interface.
  */
@@ -1030,8 +1041,6 @@ static ULONG WINAPI uia_event_Release(IWineUiaEvent *iface)
     TRACE("%p, refcount %ld\n", event, ref);
     if (!ref)
     {
-        int i;
-
         /*
          * If this event has an event_map_entry, it should've been released
          * before hitting a reference count of 0.
@@ -1057,9 +1066,7 @@ static ULONG WINAPI uia_event_Release(IWineUiaEvent *iface)
             uia_stop_event_thread();
         }

-        for (i = 0; i < event->event_advisers_count; i++)
-            IWineUiaEventAdviser_Release(event->event_advisers[i]);
-        free(event->event_advisers);
+        uia_event_clear_advisers(event);
         free(event);
     }

@@ -1102,10 +1109,7 @@ static HRESULT WINAPI uia_event_advise_events(IWineUiaEvent *iface, BOOL advise_
         uia_event_map_entry_release(event->event_map_entry);
         event->event_map_entry = NULL;

-        for (i = 0; i < event->event_advisers_count; i++)
-            IWineUiaEventAdviser_Release(event->event_advisers[i]);
-        free(event->event_advisers);
-        event->event_advisers_count = event->event_advisers_arr_size = 0;
+        uia_event_clear_advisers(event);
     }

return S_OK;

[PATCH 0/1] MR7090: uiautomationcore: Fix a double-free of advisers array (ASan). - approved

[Nikolay Sivov (＠nsivov)]

This merge request was approved by Nikolay Sivov.

[Connor McAdams (＠cmcadams)]

I'd guess alternatively we could've just assigned `event->event_advisers` to `NULL` in `uia_event_advise_events()`, but the helper function works as well and prevents this mistake happening again in the future.

Looks good to me.

[PATCH 0/1] MR7090: uiautomationcore: Fix a double-free of advisers array (ASan). - approved

[Connor McAdams (＠cmcadams)]

This merge request was approved by Connor McAdams.