From: Thomas Faber Subject: wineqtdecoder: Destroy BaseFilter after QT child class. Message-Id: <53CD6470.60308@reactos.org> Date: Mon, 21 Jul 2014 21:05:20 +0200 And another critical section use after free. From 3376f449f907da1b20735866b89e6442e98eacf6 Mon Sep 17 00:00:00 2001 From: Thomas Faber Date: Sat, 19 Jul 2014 10:41:54 +0200 Subject: wineqtdecoder: Destroy BaseFilter after QT child class. --- dlls/wineqtdecoder/qtsplitter.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/dlls/wineqtdecoder/qtsplitter.c b/dlls/wineqtdecoder/qtsplitter.c index 35dc807..8bb51a4 100644 --- a/dlls/wineqtdecoder/qtsplitter.c +++ b/dlls/wineqtdecoder/qtsplitter.c @@ -343,6 +343,7 @@ static void QT_Destroy(QTSplitter *This) This->csReceive.DebugInfo->Spare[0] = 0; DeleteCriticalSection(&This->csReceive); + BaseFilter_Destroy(&This->filter); CoTaskMemFree(This); } @@ -381,7 +382,7 @@ static HRESULT WINAPI QT_QueryInterface(IBaseFilter *iface, REFIID riid, LPVOID static ULONG WINAPI QT_Release(IBaseFilter *iface) { QTSplitter *This = impl_from_IBaseFilter(iface); - ULONG refCount = BaseFilterImpl_Release(iface); + ULONG refCount = InterlockedDecrement(&This->filter.refCount); TRACE("(%p)->() Release from %d\n", This, refCount + 1); -- 1.9.0.msysgit.0