From: Thomas Faber Subject: qcap: Destroy BaseFilter after VfwCapture child class. Message-Id: <53CD6459.6070505@reactos.org> Date: Mon, 21 Jul 2014 21:04:57 +0200 One more critical section use after free. From 923b53686505932d99c5d888fb5bfa92a313ae3a Mon Sep 17 00:00:00 2001 From: Thomas Faber Date: Sat, 19 Jul 2014 10:38:26 +0200 Subject: qcap: Destroy BaseFilter after VfwCapture child class. --- dlls/qcap/vfwcapture.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/dlls/qcap/vfwcapture.c b/dlls/qcap/vfwcapture.c index 41a05a5..6d416b7 100644 --- a/dlls/qcap/vfwcapture.c +++ b/dlls/qcap/vfwcapture.c @@ -203,7 +203,7 @@ static HRESULT WINAPI VfwCapture_QueryInterface(IBaseFilter * iface, REFIID riid static ULONG WINAPI VfwCapture_Release(IBaseFilter * iface) { VfwCapture *This = (VfwCapture *)iface; - ULONG refCount = BaseFilterImpl_Release(iface); + ULONG refCount = InterlockedDecrement(&This->filter.refCount); TRACE("%p->() New refcount: %d\n", This, refCount); @@ -225,6 +225,7 @@ static ULONG WINAPI VfwCapture_Release(IBaseFilter * iface) IPin_Disconnect(This->pOutputPin); } IPin_Release(This->pOutputPin); + BaseFilter_Destroy(&This->filter); CoTaskMemFree(This); ObjectRefCount(FALSE); } -- 1.9.0.msysgit.0