Paul Gofman : netio.sys: Check for callback address before reusing pending IO structure.

[Alexandre Julliard]

Module: wine
Branch: master
Commit: c2eb5a0f396bed647362cbdac6653dcc4a812922
URL:    https://source.winehq.org/git/wine.git/?a=commit;h=c2eb5a0f396bed647362cbdac6653dcc4a812922

Author: Paul Gofman <pgofman at codeweavers.com>
Date:   Tue Jun 23 00:27:05 2020 +0300

netio.sys: Check for callback address before reusing pending IO structure.

Signed-off-by: Paul Gofman <pgofman at codeweavers.com>
Signed-off-by: Alexandre Julliard <julliard at winehq.org>

---

 dlls/netio.sys/netio.c | 33 ++++++++++++++++++++++++---------
 1 file changed, 24 insertions(+), 9 deletions(-)

diff --git a/dlls/netio.sys/netio.c b/dlls/netio.sys/netio.c
index c9203f37ad..64ea891087 100644
--- a/dlls/netio.sys/netio.c
+++ b/dlls/netio.sys/netio.c
@@ -59,6 +59,7 @@ struct wsk_pending_io
 {
     OVERLAPPED ovr;
     TP_WAIT *tp_wait;
+    void *callback;
     IRP *irp;
 };
 
@@ -159,27 +160,41 @@ static struct wsk_pending_io *allocate_pending_io(struct wsk_socket_internal *so
         PTP_WAIT_CALLBACK socket_async_callback, IRP *irp)
 {
     struct wsk_pending_io *io = socket->pending_io;
-    unsigned int i;
+    unsigned int i, io_index;
 
+    io_index = ~0u;
     for (i = 0; i < ARRAY_SIZE(socket->pending_io); ++i)
+    {
         if (!io[i].irp)
-            break;
+        {
+            if (io[i].callback == socket_async_callback)
+            {
+                io[i].irp = irp;
+                return &io[i];
+            }
+
+            if (io_index == ~0u)
+                io_index = i;
+        }
+    }
 
-    if (i == ARRAY_SIZE(socket->pending_io))
+    if (io_index == ~0u)
     {
         FIXME("Pending io requests count exceeds limit.\n");
         return NULL;
     }
 
-    io[i].irp = irp;
+    io[io_index].irp = irp;
 
-    if (io[i].tp_wait)
-        return &io[i];
+    if (io[io_index].tp_wait)
+        CloseThreadpoolWait(io[io_index].tp_wait);
+    else
+        io[io_index].ovr.hEvent = CreateEventA(NULL, FALSE, FALSE, NULL);
 
-    io[i].ovr.hEvent = CreateEventA(NULL, FALSE, FALSE, NULL);
-    io[i].tp_wait = CreateThreadpoolWait(socket_async_callback, socket, NULL);
+    io[io_index].tp_wait = CreateThreadpoolWait(socket_async_callback, socket, NULL);
+    io[io_index].callback = socket_async_callback;
 
-    return &io[i];
+    return &io[io_index];
 }
 
 static struct wsk_pending_io *find_pending_io(struct wsk_socket_internal *socket, TP_WAIT *tp_wait)