From 3ce622b638cfaee17b4bd8caa50de3dfd873f9c6 Mon Sep 17 00:00:00 2001
From: akallabeth <akallabeth@posteo.net>
Date: Fri, 17 Sep 2021 09:27:01 +0200
Subject: [PATCH] Fixed FreeRDP_WTS* failure handling

---
 libfreerdp/core/server.c | 40 ++++++++++++++++++++--------------------
 1 file changed, 20 insertions(+), 20 deletions(-)

diff --git a/libfreerdp/core/server.c b/libfreerdp/core/server.c
index c9b740b66..423b0e71a 100644
--- a/libfreerdp/core/server.c
+++ b/libfreerdp/core/server.c
@@ -551,6 +551,8 @@ BOOL WTSVirtualChannelManagerCheckFileDescriptorEx(HANDLE hServer, BOOL autoOpen
 		buffer = (BYTE*)message.wParam;
 		length = (UINT32)(UINT_PTR)message.lParam;
 
+		WINPR_ASSERT(vcm->client);
+		WINPR_ASSERT(vcm->client->SendChannelData);
 		if (!vcm->client->SendChannelData(vcm->client, channelId, buffer, length))
 		{
 			status = FALSE;
@@ -848,6 +850,8 @@ static void wts_virtual_channel_manager_free_message(void* obj)
 	}
 }
 
+static void channel_free(rdpPeerChannel* channel);
+
 HANDLE WINAPI FreeRDP_WTSOpenServerA(LPSTR pServerName)
 {
 	rdpContext* context;
@@ -901,6 +905,11 @@ HANDLE WINAPI FreeRDP_WTSOpenServerA(LPSTR pServerName)
 	if (!vcm->dynamicVirtualChannels)
 		goto error_dynamicVirtualChannels;
 
+	{
+		wObject* obj = ArrayList_Object(vcm->dynamicVirtualChannels);
+		WINPR_ASSERT(obj);
+		obj->fnObjectFree = channel_free;
+	}
 	client->ReceiveChannelData = WTSReceiveChannelData;
 	hServer = (HANDLE)vcm;
 	return hServer;
@@ -927,25 +936,14 @@ HANDLE WINAPI FreeRDP_WTSOpenServerExA(LPSTR pServerName)
 
 VOID WINAPI FreeRDP_WTSCloseServer(HANDLE hServer)
 {
-	int index;
-	int count;
-	rdpPeerChannel* channel;
 	WTSVirtualChannelManager* vcm;
 	vcm = (WTSVirtualChannelManager*)hServer;
 
-	if (vcm)
+	if (vcm && (vcm != INVALID_HANDLE_VALUE))
 	{
 		HashTable_Remove(g_ServerHandles, (void*)(UINT_PTR)vcm->SessionId);
-		ArrayList_Lock(vcm->dynamicVirtualChannels);
-		count = ArrayList_Count(vcm->dynamicVirtualChannels);
 
-		for (index = 0; index < count; index++)
-		{
-			channel = (rdpPeerChannel*)ArrayList_GetItem(vcm->dynamicVirtualChannels, index);
-			WTSVirtualChannelClose(channel);
-		}
-
-		ArrayList_Unlock(vcm->dynamicVirtualChannels);
+		ArrayList_Clear(vcm->dynamicVirtualChannels);
 		ArrayList_Free(vcm->dynamicVirtualChannels);
 
 		if (vcm->drdynvc_channel)
@@ -1110,7 +1108,7 @@ static void peer_channel_queue_free_message(void* obj)
 	free(msg->context);
 }
 
-static void channel_free(rdpPeerChannel* channel)
+void channel_free(rdpPeerChannel* channel)
 {
 	if (!channel)
 		return;
@@ -1143,6 +1141,7 @@ static rdpPeerChannel* channel_new(WTSVirtualChannelManager* vcm, freerdp_peer*
 		goto fail;
 
 	queueCallbacks.fnObjectFree = peer_channel_queue_free_message;
+
 	channel->queue = MessageQueue_New(&queueCallbacks);
 
 	if (!channel->queue)
@@ -1287,22 +1286,23 @@ HANDLE WINAPI FreeRDP_WTSVirtualChannelOpenEx(DWORD SessionId, LPSTR pVirtualNam
 	s = Stream_New(NULL, 64);
 
 	if (!s)
-		goto fail;
+		goto fail2;
 
 	if (!wts_write_drdynvc_create_request(s, channel->channelId, pVirtualName))
-		goto fail;
+		goto fail2;
 
 	if (!WTSVirtualChannelWrite(vcm->drdynvc_channel, (PCHAR)Stream_Buffer(s),
 	                            Stream_GetPosition(s), &written))
-		goto fail;
+		goto fail2;
 
 	Stream_Free(s, TRUE);
 	return channel;
 fail:
-	Stream_Free(s, TRUE);
-	if (vcm)
-		ArrayList_Remove(vcm->dynamicVirtualChannels, channel);
 	channel_free(channel);
+fail2:
+	Stream_Free(s, TRUE);
+	ArrayList_Remove(vcm->dynamicVirtualChannels, channel);
+
 	SetLastError(ERROR_NOT_ENOUGH_MEMORY);
 	return NULL;
 }