[PATCH] Remove potential reference count races

[max at mtew.isa-geek.net]

From: Max TenEyck Woodbury <max at mtew.isa-geek.net>

---
 dlls/ole32/rpc.c |   36 ++++++++++++++++++------------------
 1 files changed, 18 insertions(+), 18 deletions(-)

diff --git a/dlls/ole32/rpc.c b/dlls/ole32/rpc.c
index 9b57206..7f6a6f5 100644
--- a/dlls/ole32/rpc.c
+++ b/dlls/ole32/rpc.c
@@ -200,7 +200,7 @@ static ULONG ChannelHooks_ClientGetSize(SChannelHookCallInfo *info,
     EnterCriticalSection(&csChannelHook);
 
     LIST_FOR_EACH_ENTRY(entry, &channel_hooks, struct channel_hook_entry, entry)
-        (*hook_count)++;
+        ++(*hook_count);
 
     if (*hook_count)
         *data = HeapAlloc(GetProcessHeap(), 0, *hook_count * sizeof(struct channel_hook_buffer_data));
@@ -223,10 +223,10 @@ static ULONG ChannelHooks_ClientGetSize(SChannelHookCallInfo *info,
         if (extension_size)
         {
             total_size += FIELD_OFFSET(WIRE_ORPC_EXTENT, data[extension_size]);
-            (*extension_count)++;
+            ++(*extension_count);
         }
 
-        hook_index++;
+        ++hook_index;
     }
 
     LeaveCriticalSection(&csChannelHook);
@@ -248,7 +248,7 @@ static unsigned char * ChannelHooks_ClientFillBuffer(SChannelHookCallInfo *info,
         ULONG extension_size = 0;
         WIRE_ORPC_EXTENT *wire_orpc_extent = (WIRE_ORPC_EXTENT *)buffer;
 
-        for (i = 0; i < hook_count; i++)
+        for (i = 0; i < hook_count; ++i)
             if (IsEqualGUID(&entry->id, &data[i].id))
                 extension_size = data[i].extension_size;
 
@@ -288,7 +288,7 @@ static void ChannelHooks_ServerNotify(SChannelHookCallInfo *info,
         WIRE_ORPC_EXTENT *wire_orpc_extent;
         for (i = 0, wire_orpc_extent = first_wire_orpc_extent;
              i < extension_count;
-             i++, wire_orpc_extent = (WIRE_ORPC_EXTENT *)&wire_orpc_extent->data[wire_orpc_extent->conformance])
+             ++i, wire_orpc_extent = (WIRE_ORPC_EXTENT *)&wire_orpc_extent->data[wire_orpc_extent->conformance])
         {
             if (IsEqualGUID(&entry->id, &wire_orpc_extent->id))
                 break;
@@ -318,7 +318,7 @@ static ULONG ChannelHooks_ServerGetSize(SChannelHookCallInfo *info,
     EnterCriticalSection(&csChannelHook);
 
     LIST_FOR_EACH_ENTRY(entry, &channel_hooks, struct channel_hook_entry, entry)
-        (*hook_count)++;
+        ++(*hook_count);
 
     if (*hook_count)
         *data = HeapAlloc(GetProcessHeap(), 0, *hook_count * sizeof(struct channel_hook_buffer_data));
@@ -342,10 +342,10 @@ static ULONG ChannelHooks_ServerGetSize(SChannelHookCallInfo *info,
         if (extension_size)
         {
             total_size += FIELD_OFFSET(WIRE_ORPC_EXTENT, data[extension_size]);
-            (*extension_count)++;
+            ++(*extension_count);
         }
 
-        hook_index++;
+        ++hook_index;
     }
 
     LeaveCriticalSection(&csChannelHook);
@@ -367,7 +367,7 @@ static unsigned char * ChannelHooks_ServerFillBuffer(SChannelHookCallInfo *info,
         ULONG extension_size = 0;
         WIRE_ORPC_EXTENT *wire_orpc_extent = (WIRE_ORPC_EXTENT *)buffer;
 
-        for (i = 0; i < hook_count; i++)
+        for (i = 0; i < hook_count; ++i)
             if (IsEqualGUID(&entry->id, &data[i].id))
                 extension_size = data[i].extension_size;
 
@@ -408,7 +408,7 @@ static void ChannelHooks_ClientNotify(SChannelHookCallInfo *info,
         WIRE_ORPC_EXTENT *wire_orpc_extent;
         for (i = 0, wire_orpc_extent = first_wire_orpc_extent;
              i < extension_count;
-             i++, wire_orpc_extent = (WIRE_ORPC_EXTENT *)&wire_orpc_extent->data[wire_orpc_extent->conformance])
+             ++i, wire_orpc_extent = (WIRE_ORPC_EXTENT *)&wire_orpc_extent->data[wire_orpc_extent->conformance])
         {
             if (IsEqualGUID(&entry->id, &wire_orpc_extent->id))
                 break;
@@ -905,9 +905,9 @@ static HRESULT WINAPI ClientRpcChannelBuffer_SendReceive(LPRPCCHANNELBUFFER ifac
     {
         if (WaitForSingleObject(message_state->params.handle, 0))
         {
-            COM_CurrentInfo()->pending_call_count_client++;
+            ++COM_CurrentInfo()->pending_call_count_client;
             hr = CoWaitForMultipleHandles(0, INFINITE, 1, &message_state->params.handle, &index);
-            COM_CurrentInfo()->pending_call_count_client--;
+            --COM_CurrentInfo()->pending_call_count_client;
         }
     }
     ClientRpcChannelBuffer_ReleaseEventHandle(This, message_state->params.handle);
@@ -1210,7 +1210,7 @@ static HRESULT unmarshal_ORPC_EXTENT_ARRAY(RPC_MESSAGE *msg, const char *end,
         }
 
         *first_wire_orpc_extent = wire_orpc_extent = msg->Buffer;
-        for (i = 0; i < ((extensions->size+1)&~1); i++)
+        for (i = 0; i < ((extensions->size+1)&~1); ++i)
         {
             if ((const char *)&wire_orpc_extent->data[0] > end)
                 return RPC_S_INVALID_BOUND;
@@ -1418,9 +1418,9 @@ void RPC_ExecuteCall(struct dispatch_params *params)
      * this call - this should be checked with what Windows does */
     old_causality_id = COM_CurrentInfo()->causality_id;
     COM_CurrentInfo()->causality_id = orpcthis.cid;
-    COM_CurrentInfo()->pending_call_count_server++;
+    ++COM_CurrentInfo()->pending_call_count_server;
     params->hr = IRpcStubBuffer_Invoke(params->stub, params->msg, params->chan);
-    COM_CurrentInfo()->pending_call_count_server--;
+    --COM_CurrentInfo()->pending_call_count_server;
     COM_CurrentInfo()->causality_id = old_causality_id;
 
     /* the invoke allocated a new buffer, so free the old one */
@@ -1535,7 +1535,7 @@ HRESULT RPC_RegisterInterface(REFIID riid)
     {
         if (IsEqualGUID(&rif->If.InterfaceId.SyntaxGUID, riid))
         {
-            rif->refs++;
+            InterlockedIncrement(&rif->refs);
             found = TRUE;
             break;
         }
@@ -1587,7 +1587,7 @@ void RPC_UnregisterInterface(REFIID riid)
     {
         if (IsEqualGUID(&rif->If.InterfaceId.SyntaxGUID, riid))
         {
-            if (!--rif->refs)
+            if (!InterlockedDecrement(&rif->refs))
             {
                 RpcServerUnregisterIf((RPC_IF_HANDLE)&rif->If, NULL, TRUE);
                 list_remove(&rif->entry);
@@ -1768,7 +1768,7 @@ static HRESULT create_local_service(REFCLSID rclsid)
         if (r == ERROR_SUCCESS && type == REG_SZ && sz)
         {
             args[0] = HeapAlloc(GetProcessHeap(),HEAP_ZERO_MEMORY,sz);
-            num_args++;
+            ++num_args;
             RegQueryValueExW(hkey, szServiceParams, NULL, &type, (LPBYTE)args[0], &sz);
         }
         r = start_local_service(buf, num_args, (LPCWSTR *)args);
-- 
1.7.7.6