From 95a7447366d754f6c0682f96845c0c5cf00c792e Mon Sep 17 00:00:00 2001
From: Armin Novak <armin.novak@thincast.com>
Date: Thu, 9 May 2019 13:23:25 +0200
Subject: [PATCH] Fixed window order cleanup for NOTIFY_ICON_STATE_ORDER

---
 libfreerdp/core/update.c |  6 +++++-
 libfreerdp/core/window.c | 23 +++++++++++++++++++----
 libfreerdp/core/window.h |  1 -
 3 files changed, 24 insertions(+), 6 deletions(-)

diff --git a/libfreerdp/core/update.c b/libfreerdp/core/update.c
index 65ff7d7..bcf2d51 100644
--- a/libfreerdp/core/update.c
+++ b/libfreerdp/core/update.c
@@ -92,6 +92,7 @@ static BOOL update_recv_orders(rdpUpdate* update, wStream* s)
 static BOOL update_read_bitmap_data(rdpUpdate* update, wStream* s,
                                     BITMAP_DATA* bitmapData)
 {
+	WINPR_UNUSED(update);
 	if (Stream_GetRemainingLength(s) < 18)
 		return FALSE;
 
@@ -294,6 +295,7 @@ fail:
 
 static void update_read_synchronize(rdpUpdate* update, wStream* s)
 {
+	WINPR_UNUSED(update);
 	Stream_Seek_UINT16(s); /* pad2Octets (2 bytes) */
 	/**
 	 * The Synchronize Update is an artifact from the
@@ -956,9 +958,10 @@ static int update_prepare_order_info(rdpContext* context,
 }
 
 int update_write_order_info(rdpContext* context, wStream* s,
-                            ORDER_INFO* orderInfo, int offset)
+							ORDER_INFO* orderInfo, size_t offset)
 {
 	size_t position;
+	WINPR_UNUSED(context);
 	position = Stream_GetPosition(s);
 	Stream_SetPosition(s, offset);
 	Stream_Write_UINT8(s, orderInfo->controlFlags); /* controlFlags (1 byte) */
@@ -2152,6 +2155,7 @@ rdpUpdate* update_new(rdpRdp* rdp)
 	const wObject cb = { NULL, NULL, NULL,  update_free_queued_message, NULL };
 	rdpUpdate* update;
 	OFFSCREEN_DELETE_LIST* deleteList;
+	WINPR_UNUSED(rdp);
 	update = (rdpUpdate*) calloc(1, sizeof(rdpUpdate));
 
 	if (!update)
diff --git a/libfreerdp/core/window.c b/libfreerdp/core/window.c
index f9ba18b..fa9ee3c 100644
--- a/libfreerdp/core/window.c
+++ b/libfreerdp/core/window.c
@@ -30,6 +30,8 @@
 
 #define TAG FREERDP_TAG("core.window")
 
+static void update_free_window_icon_info(ICON_INFO* iconInfo);
+
 BOOL rail_read_unicode_string(wStream* s, RAIL_UNICODE_STRING* unicode_string)
 {
 	UINT16 new_len;
@@ -446,7 +448,7 @@ static BOOL update_read_window_state_order(wStream* s, WINDOW_ORDER_INFO* orderI
 static BOOL update_read_window_icon_order(wStream* s, WINDOW_ORDER_INFO* orderInfo,
         WINDOW_ICON_ORDER* window_icon)
 {
-	update_free_window_icon_info(window_icon->iconInfo);
+	WINPR_UNUSED(orderInfo);
 	window_icon->iconInfo = (ICON_INFO*) calloc(1, sizeof(ICON_INFO));
 
 	if (!window_icon->iconInfo)
@@ -458,6 +460,7 @@ static BOOL update_read_window_icon_order(wStream* s, WINDOW_ORDER_INFO* orderIn
 static BOOL update_read_window_cached_icon_order(wStream* s, WINDOW_ORDER_INFO* orderInfo,
         WINDOW_CACHED_ICON_ORDER* window_cached_icon)
 {
+	WINPR_UNUSED(orderInfo);
 	return update_read_cached_icon_info(s,
 	                                    &window_cached_icon->cachedIcon); /* cachedIcon (CACHED_ICON_INFO) */
 }
@@ -519,6 +522,7 @@ static BOOL update_recv_window_info_order(rdpUpdate* update, wStream* s,
 		}
 
 		update_free_window_icon_info(window_icon.iconInfo);
+		free(window_icon.iconInfo);
 	}
 	else if (orderInfo->fieldFlags & WINDOW_ORDER_CACHED_ICON)
 	{
@@ -562,6 +566,15 @@ static BOOL update_recv_window_info_order(rdpUpdate* update, wStream* s,
 	return result;
 }
 
+static void update_notify_icon_state_order_free(NOTIFY_ICON_STATE_ORDER* notify)
+{
+	free(notify->toolTip.string);
+	free(notify->infoTip.text.string);
+	free(notify->infoTip.title.string);
+	update_free_window_icon_info(&notify->icon);
+	memset(notify, 0, sizeof(NOTIFY_ICON_STATE_ORDER));
+}
+
 static BOOL update_read_notification_icon_state_order(wStream* s, WINDOW_ORDER_INFO* orderInfo,
         NOTIFY_ICON_STATE_ORDER* notify_icon_state)
 {
@@ -637,9 +650,10 @@ static BOOL update_recv_notification_icon_info_order(rdpUpdate* update, wStream*
 	else
 	{
 		NOTIFY_ICON_STATE_ORDER notify_icon_state = { 0 };
+		result = update_read_notification_icon_state_order(s, orderInfo, &notify_icon_state);
 
-		if (!update_read_notification_icon_state_order(s, orderInfo, &notify_icon_state))
-			return FALSE;
+		if (!result)
+			goto fail;
 
 		if (orderInfo->fieldFlags & WINDOW_ORDER_STATE_NEW)
 		{
@@ -651,6 +665,8 @@ static BOOL update_recv_notification_icon_info_order(rdpUpdate* update, wStream*
 			WLog_Print(update->log, WLOG_DEBUG, "NotifyIconUpdate");
 			IFCALLRET(window->NotifyIconUpdate, result, context, orderInfo, &notify_icon_state);
 		}
+		fail:
+			update_notify_icon_state_order_free(&notify_icon_state);
 	}
 
 	return result;
@@ -753,7 +769,6 @@ void update_free_window_icon_info(ICON_INFO* iconInfo)
 	iconInfo->bitsMask = NULL;
 	free(iconInfo->colorTable);
 	iconInfo->colorTable = NULL;
-	free(iconInfo);
 }
 
 BOOL update_recv_altsec_window_order(rdpUpdate* update, wStream* s)
diff --git a/libfreerdp/core/window.h b/libfreerdp/core/window.h
index 52b4edf..4a0c241 100644
--- a/libfreerdp/core/window.h
+++ b/libfreerdp/core/window.h
@@ -27,7 +27,6 @@
 #include <freerdp/log.h>
 #include <freerdp/api.h>
 
-FREERDP_LOCAL void update_free_window_icon_info(ICON_INFO* iconInfo);
 FREERDP_LOCAL BOOL update_recv_altsec_window_order(rdpUpdate* update,
         wStream* s);
 FREERDP_LOCAL void update_free_window_state(WINDOW_STATE_ORDER* window_state);
-- 
2.7.4