From 622bb7b4402491ca003f47472d0e478132673696 Mon Sep 17 00:00:00 2001
From: akallabeth <akallabeth@posteo.net>
Date: Mon, 26 Jan 2026 10:48:14 +0100
Subject: [PATCH] [channels,rdpsnd] terminate thread before free

Ensure that the optional rdpsnd thread is terminated and the message
queue freed up before releasing the channel context memory
---
 channels/rdpsnd/client/rdpsnd_main.c | 28 +++++++++++++++++++---------
 1 file changed, 19 insertions(+), 9 deletions(-)

diff --git a/channels/rdpsnd/client/rdpsnd_main.c b/channels/rdpsnd/client/rdpsnd_main.c
index 49c763a87..61a29ec40 100644
--- a/channels/rdpsnd/client/rdpsnd_main.c
+++ b/channels/rdpsnd/client/rdpsnd_main.c
@@ -1278,11 +1278,29 @@ fail:
 	return CHANNEL_RC_NO_MEMORY;
 }
 
+static void rdpsnd_terminate_thread(rdpsndPlugin* rdpsnd)
+{
+	WINPR_ASSERT(rdpsnd);
+	if (rdpsnd->queue)
+		MessageQueue_PostQuit(rdpsnd->queue, 0);
+
+	if (rdpsnd->thread)
+	{
+		(void)WaitForSingleObject(rdpsnd->thread, INFINITE);
+		(void)CloseHandle(rdpsnd->thread);
+	}
+
+	MessageQueue_Free(rdpsnd->queue);
+	rdpsnd->thread = NULL;
+	rdpsnd->queue = NULL;
+}
+
 static void cleanup_internals(rdpsndPlugin* rdpsnd)
 {
 	if (!rdpsnd)
 		return;
 
+	rdpsnd_terminate_thread(rdpsnd);
 	if (rdpsnd->pool)
 		StreamPool_Return(rdpsnd->pool, rdpsnd->data_in);
 
@@ -1460,15 +1478,7 @@ void rdpsnd_virtual_channel_event_terminated(rdpsndPlugin* rdpsnd)
 {
 	if (rdpsnd)
 	{
-		if (rdpsnd->queue)
-			MessageQueue_PostQuit(rdpsnd->queue, 0);
-
-		if (rdpsnd->thread)
-		{
-			(void)WaitForSingleObject(rdpsnd->thread, INFINITE);
-			(void)CloseHandle(rdpsnd->thread);
-		}
-		MessageQueue_Free(rdpsnd->queue);
+		rdpsnd_terminate_thread(rdpsnd);
 
 		free_internals(rdpsnd);
 		audio_formats_free(rdpsnd->fixed_format, 1);
-- 
2.53.0

