crash in prunsrv

[Lode Leroy]

Hi,

I see frequent crashes in prunsrv.exe on Windows 10.

Here is a stack trace from a minidump:

     ntdll.dll!00007ff903af6e1e()    Unknown
     AcLayers.dll!00007ff87cd77a56()    Unknown
     prunsrv.exe!HeapFREE(void * hHeap, unsigned long dwFlags, void *
lpMem) Line 71    C
     prunsrv.exe!__apxPoolFreeCore(void * lpMem) Line 133    C
     prunsrv.exe!apxFree(void * lpMem) Line 402    C
     prunsrv.exe!__apxProcessCallback(stAPXHANDLE * hObject, unsigned int
uMsg, unsigned __int64 wParam, __int64 lParam) Line 396    C
     prunsrv.exe!apxCloseHandle(stAPXHANDLE * hObject) Line 498    C
     prunsrv.exe!__apxPoolCallback(stAPXHANDLE * hObject, unsigned int
uMsg, unsigned __int64 wParam, __int64 lParam) Line 190    C
     prunsrv.exe!__apxPoolCallback(stAPXHANDLE * hObject, unsigned int
uMsg, unsigned __int64 wParam, __int64 lParam) Line 184    C
     prunsrv.exe!apxCloseHandle(stAPXHANDLE * hObject) Line 498    C
     prunsrv.exe!apxHandleManagerDestroy(...) Line 291    C
     prunsrv.exe!main(int argc, char * * argv) Line 1830    C


I fixed it locally as follows, but I'm not sure if this is a good way to
fix it.


diff --git a/windows/src/handles.c b/windows/src/handles.c
index bdd573d..b90f677 100644
--- a/windows/src/handles.c
+++ b/windows/src/handles.c
@@ -286,6 +286,7 @@ apxHandleManagerDestroy()

     if (--_st_sys_init == 0) {
         hHeap = _st_sys_pool->hHeap;
+        _st_sys_pool->fnCallback = NULL;
         apxCloseHandle(_st_sys_pool);
         /* Destroy the main Heap */
         HeapDESTROY(hHeap);
@@ -493,7 +494,8 @@ apxCloseHandle(APXHANDLE hObject)
     if (IS_INVALID_HANDLE(hObject) || hObject->dwType ==
APXHANDLE_TYPE_INVALID)
         return FALSE;
     /* Call the user callback first */
-    (*hObject->fnCallback)(hObject, WM_CLOSE, 0, 0);
+    if (*hObject->fnCallback)
+        (*hObject->fnCallback)(hObject, WM_CLOSE, 0, 0);
     /* Now go through the callback chain */
     TAILQ_FOREACH(lpCall, &hObject->lCallbacks, queue) {
         (*lpCall->fnCallback)(hObject, WM_CLOSE, 0, 0);