Brendan McGrath : qedit: Do not force the sample to be freed in SampleGrabber_callback().

[Alexandre Julliard]

Module: wine
Branch: master
Commit: 1113f42aa748d9e0a27c4663b9d8de1237f95e73
URL:    https://gitlab.winehq.org/wine/wine/-/commit/1113f42aa748d9e0a27c4663b9d8de1237f95e73

Author: Brendan McGrath <brendan at redmandi.com>
Date:   Sun Jul 17 12:38:09 2022 +1000

qedit: Do not force the sample to be freed in SampleGrabber_callback().

Remove a work around that causes a crash in Unravel Two.

There is a callback in Unravel Two that appears to add a reference to a
IMediaSample, which this workaround treats as a leak and releases. However, the
application also later releases the reference itself, causing a use-after-free.

Wine-Bug: https://bugs.winehq.org/show_bug.cgi?id=51616
Signed-off-by: Brendan McGrath <brendan at redmandi.com>
Signed-off-by: Zebediah Figura <zfigura at codeweavers.com>
Signed-off-by: Alexandre Julliard <julliard at winehq.org>

---

 dlls/qedit/samplegrabber.c  | 3 ---
 dlls/qedit/tests/mediadet.c | 2 +-
 2 files changed, 1 insertion(+), 4 deletions(-)

diff --git a/dlls/qedit/samplegrabber.c b/dlls/qedit/samplegrabber.c
index 9b9780e564a..cefb2f37078 100644
--- a/dlls/qedit/samplegrabber.c
+++ b/dlls/qedit/samplegrabber.c
@@ -164,9 +164,6 @@ static void SampleGrabber_callback(struct sample_grabber *This, IMediaSample *sa
 		if (ref)
 		{
 		    ERR("(%p) Callback referenced sample %p by %lu\n", This, sample, ref);
-		    /* ugly as hell but some apps are sooo buggy */
-		    while (ref--)
-			IMediaSample_Release(sample);
 		}
 	    }
             break;
diff --git a/dlls/qedit/tests/mediadet.c b/dlls/qedit/tests/mediadet.c
index 6e7017f865c..05805c56eb5 100644
--- a/dlls/qedit/tests/mediadet.c
+++ b/dlls/qedit/tests/mediadet.c
@@ -1094,7 +1094,7 @@ static void test_samplegrabber(void)
     ok(samplecb_called == TRUE, "SampleCB should have been called\n");
 
     refcount = IUnknown_Release(&my_sample.sample);
-    todo_wine ok(!refcount, "Got unexpected refcount %ld.\n", refcount);
+    ok(!refcount, "Got unexpected refcount %ld.\n", refcount);
 
     IMemInputPin_Release(inpin);
     IPin_Release(pin);