From 75f5b641f2d3b54af2b79f59a3d7840e29cd45ea Mon Sep 17 00:00:00 2001
From: Magnus Olsen <magnus@greatlord.com>
Date: Thu, 14 Dec 2006 10:53:35 +0000
Subject: [PATCH] make the cleanup working as it should, do not crash when it
 try free unlinked dd interface.

svn path=/trunk/; revision=25158
---
 reactos/dll/directx/ddraw/cleanup.c         | 11 +++++++++--
 reactos/dll/directx/ddraw/main/ddraw_main.c |  9 +++------
 2 files changed, 12 insertions(+), 8 deletions(-)

diff --git a/reactos/dll/directx/ddraw/cleanup.c b/reactos/dll/directx/ddraw/cleanup.c
index 813365c1020..1bc1052e08a 100644
--- a/reactos/dll/directx/ddraw/cleanup.c
+++ b/reactos/dll/directx/ddraw/cleanup.c
@@ -17,6 +17,8 @@ Cleanup(LPDIRECTDRAW7 iface)
 {
     LPDDRAWI_DIRECTDRAW_INT This = (LPDDRAWI_DIRECTDRAW_INT)iface;
 
+    DX_WINDBG_trace();
+
     if (ddgbl.lpDDCBtmp != NULL)
     {
         DxHeapMemFree(ddgbl.lpDDCBtmp);
@@ -34,7 +36,7 @@ Cleanup(LPDIRECTDRAW7 iface)
     */
 
     /* release the linked interface */
-    while (This->lpVtbl != NULL)
+    while (!IsBadWritePtr( This->lpVtbl, sizeof( LPDDRAWI_DIRECTDRAW_INT )) )
     {
         LPDDRAWI_DIRECTDRAW_INT newThis = This->lpVtbl;
         if (This->lpLcl != NULL)
@@ -42,7 +44,8 @@ Cleanup(LPDIRECTDRAW7 iface)
             DeleteDC(This->lpLcl->hDC);
             DxHeapMemFree(This->lpLcl);
         }
-        
+
+        DxHeapMemFree(This);
         This = newThis;
     }
 
@@ -52,6 +55,10 @@ Cleanup(LPDIRECTDRAW7 iface)
         DeleteDC(This->lpLcl->hDC);
         DxHeapMemFree(This->lpLcl);
     }
+    if (This != NULL)
+    {
+        DxHeapMemFree(This);
+    }
 
 }
 
diff --git a/reactos/dll/directx/ddraw/main/ddraw_main.c b/reactos/dll/directx/ddraw/main/ddraw_main.c
index 7f1b2f10108..10efabdae4b 100644
--- a/reactos/dll/directx/ddraw/main/ddraw_main.c
+++ b/reactos/dll/directx/ddraw/main/ddraw_main.c
@@ -85,7 +85,7 @@ Main_DirectDraw_Release (LPDIRECTDRAW7 iface)
             This->lpLcl->lpGbl->dwRefCnt--;
         }
 
-        if ( This->dwIntRefCnt == 0)
+        if ( This->lpLcl->lpGbl->dwRefCnt == 0)
         {
             // set resoltion back to the one in registry
             /*if(This->cooperative_level & DDSCL_EXCLUSIVE)
@@ -94,13 +94,10 @@ Main_DirectDraw_Release (LPDIRECTDRAW7 iface)
             }*/
             
             Cleanup(iface);
-            if (This!=NULL)
-            {
-                HeapFree(GetProcessHeap(), 0, This);
-            }
+            return 0;
         }
     }
-    return This ? This->dwIntRefCnt : 0;
+    return This->dwIntRefCnt;
 }
 
 /*