From e02e052f6692550e539d10f99de9c35a23492db2 Mon Sep 17 00:00:00 2001 From: akallabeth Date: Mon, 26 Jan 2026 10:06:29 +0100 Subject: [PATCH] [channels,drdynvc] reset channel_callback before close The channel_callback usually frees up the memory of the callback. To ensure that there is no access to any of the data structures in it invalidate the pointer used to access it before a free. --- channels/drdynvc/client/drdynvc_main.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) Index: FreeRDP-3.10.3/channels/drdynvc/client/drdynvc_main.c =================================================================== --- FreeRDP-3.10.3.orig/channels/drdynvc/client/drdynvc_main.c +++ FreeRDP-3.10.3/channels/drdynvc/client/drdynvc_main.c @@ -485,16 +485,15 @@ static UINT dvcman_channel_close(DVCMAN_ } channel->state = DVC_CHANNEL_CLOSED; + check_open_close_receive(channel); IWTSVirtualChannelCallback* cb = channel->channel_callback; + channel->channel_callback = NULL; if (cb) { - check_open_close_receive(channel); IFCALL(cb->OnClose, cb); } - channel->channel_callback = NULL; - if (channel->dvcman && channel->dvcman->drdynvc) { if (context) @@ -767,14 +767,13 @@ out: */ static UINT dvcman_open_channel(drdynvcPlugin* drdynvc, DVCMAN_CHANNEL* channel) { - IWTSVirtualChannelCallback* pCallback = NULL; UINT error = CHANNEL_RC_OK; WINPR_ASSERT(drdynvc); WINPR_ASSERT(channel); if (channel->state == DVC_CHANNEL_RUNNING) { - pCallback = channel->channel_callback; + IWTSVirtualChannelCallback* pCallback = channel->channel_callback; if (pCallback->OnOpen) {