wineqtdecoder: Destroy BaseFilter after QT child class.

[Thomas Faber]

And another critical section use after free.
-------------- next part --------------
From 3376f449f907da1b20735866b89e6442e98eacf6 Mon Sep 17 00:00:00 2001
From: Thomas Faber <thomas.faber at reactos.org>
Date: Sat, 19 Jul 2014 10:41:54 +0200
Subject: wineqtdecoder: Destroy BaseFilter after QT child class.

---
 dlls/wineqtdecoder/qtsplitter.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/dlls/wineqtdecoder/qtsplitter.c b/dlls/wineqtdecoder/qtsplitter.c
index 35dc807..8bb51a4 100644
--- a/dlls/wineqtdecoder/qtsplitter.c
+++ b/dlls/wineqtdecoder/qtsplitter.c
@@ -343,6 +343,7 @@ static void QT_Destroy(QTSplitter *This)
 
     This->csReceive.DebugInfo->Spare[0] = 0;
     DeleteCriticalSection(&This->csReceive);
+    BaseFilter_Destroy(&This->filter);
 
     CoTaskMemFree(This);
 }
@@ -381,7 +382,7 @@ static HRESULT WINAPI QT_QueryInterface(IBaseFilter *iface, REFIID riid, LPVOID
 static ULONG WINAPI QT_Release(IBaseFilter *iface)
 {
     QTSplitter *This = impl_from_IBaseFilter(iface);
-    ULONG refCount = BaseFilterImpl_Release(iface);
+    ULONG refCount = InterlockedDecrement(&This->filter.refCount);
 
     TRACE("(%p)->() Release from %d\n", This, refCount + 1);
 
-- 
1.9.0.msysgit.0