Fix another UAF that could be causing crashes

yungcomputerchair · yungcomputerchair · commit 86012cf2a1a8 · 2026-05-09T22:42:57.000-07:00
diff --git a/requests.c b/requests.c
@@ -571,10 +571,12 @@ handle_request(PTP_CALLBACK_INSTANCE inst, void *reqArg, PTP_WORK work)
 {
     Request *req;
     HANDLE doneEvent;
+    HANDLE readyEvent;
     bool done;
 
     req = (Request *)reqArg;
     doneEvent = req->doneEvent;
+    readyEvent = req->readyEvent;
     done = false;
     while (!done) {
         if (req->source == REQ_SRC_UNSET) {
@@ -600,7 +602,7 @@ handle_request(PTP_CALLBACK_INSTANCE inst, void *reqArg, PTP_WORK work)
         } else {
             /* notify main thread to pipe progress to the plugin */
             PostMessageW(hwnd, ioMsg, (WPARAM)NULL, (LPARAM)req);
-            WaitForSingleObject(req->readyEvent, INFINITE);
+            WaitForSingleObject(readyEvent, INFINITE);
         }
     }
 

Original file line number	Diff line number	Diff line change
`@@ -571,10 +571,12 @@ handle_request(PTP_CALLBACK_INSTANCE inst, void *reqArg, PTP_WORK work)`
`571`	`571`	`{`
`572`	`572`	`Request *req;`
`573`	`573`	`HANDLE doneEvent;`
	`574`	`+ HANDLE readyEvent;`
`574`	`575`	`bool done;`
`575`	`576`
`576`	`577`	`req = (Request *)reqArg;`
`577`	`578`	`doneEvent = req->doneEvent;`
	`579`	`+ readyEvent = req->readyEvent;`
`578`	`580`	`done = false;`
`579`	`581`	`while (!done) {`
`580`	`582`	`if (req->source == REQ_SRC_UNSET) {`
`@@ -600,7 +602,7 @@ handle_request(PTP_CALLBACK_INSTANCE inst, void *reqArg, PTP_WORK work)`
`600`	`602`	`} else {`
`601`	`603`	`/* notify main thread to pipe progress to the plugin */`
`602`	`604`	`PostMessageW(hwnd, ioMsg, (WPARAM)NULL, (LPARAM)req);`
`603`		`- WaitForSingleObject(req->readyEvent, INFINITE);`
	`605`	`+ WaitForSingleObject(readyEvent, INFINITE);`
`604`	`606`	`}`
`605`	`607`	`}`
`606`	`608`