Index: /trunk/src/VBox/Additions/common/VBoxService/VBoxServiceControl.cpp
===================================================================
--- /trunk/src/VBox/Additions/common/VBoxService/VBoxServiceControl.cpp	(revision 28408)
+++ /trunk/src/VBox/Additions/common/VBoxService/VBoxServiceControl.cpp	(revision 28409)
@@ -242,7 +242,5 @@
          it != g_GuestControlExecThreads.end(); it++)
     {
-        PVBOXSERVICECTRLTHREAD pThread = (*it);
-        AssertPtr(pThread);
-        ASMAtomicXchgBool(&pThread->fShutdown, true);
+        ASMAtomicXchgBool(&(*it)->fShutdown, true);
     }
     
@@ -250,14 +248,18 @@
          it != g_GuestControlExecThreads.end(); it++)
     {
-        PVBOXSERVICECTRLTHREAD pThread = (*it);
-        if (pThread->Thread != NIL_RTTHREAD)
-        {
-            int rc2 = RTThreadWait(pThread->Thread, 30 * 1000 /* Wait 30 second */, NULL);
+        if ((*it)->Thread != NIL_RTTHREAD)
+        {
+            int rc2 = RTThreadWait((*it)->Thread, 30 * 1000 /* Wait 30 second */, NULL);
             if (RT_FAILURE(rc2))
-                VBoxServiceError("Control: Thread (PID: %u) failed to stop; rc2=%Rrc\n", pThread->uPID, rc2);
-        }
-        VBoxServiceControlExecDestroyThread(pThread);
-    }
-
+                VBoxServiceError("Control: Thread (PID: %u) failed to stop; rc2=%Rrc\n", (*it)->uPID, rc2);
+        }
+        VBoxServiceControlExecDestroyThreadData((*it));
+    }
+
+    for (GuestCtrlExecListIter it = g_GuestControlExecThreads.begin();
+         it != g_GuestControlExecThreads.end(); it++)
+            RTMemFree((*it));
+
+    g_GuestControlExecThreads.clear();
     VbglR3GuestCtrlDisconnect(g_GuestControlSvcClientID);
     g_GuestControlSvcClientID = 0;
Index: /trunk/src/VBox/Additions/common/VBoxService/VBoxServiceControlExec.cpp
===================================================================
--- /trunk/src/VBox/Additions/common/VBoxService/VBoxServiceControlExec.cpp	(revision 28408)
+++ /trunk/src/VBox/Additions/common/VBoxService/VBoxServiceControlExec.cpp	(revision 28409)
@@ -528,14 +528,13 @@
 
 /** Allocates and gives back a thread data struct which then can be used by the worker thread. */
-PVBOXSERVICECTRLTHREAD VBoxServiceControlExecAllocateThreadData(uint32_t u32ContextID, 
-                                                                const char *pszCmd, uint32_t uFlags, 
-                                                                const char *pszArgs, uint32_t uNumArgs,                                           
-                                                                const char *pszEnv, uint32_t cbEnv, uint32_t uNumEnvVars,
-                                                                const char *pszStdIn, const char *pszStdOut, const char *pszStdErr,
-                                                                const char *pszUser, const char *pszPassword, uint32_t uTimeLimitMS)
-{
-    PVBOXSERVICECTRLTHREAD pThread = (PVBOXSERVICECTRLTHREAD)RTMemAlloc(sizeof(VBOXSERVICECTRLTHREAD));
-    if (pThread == NULL)
-        return NULL;
+int VBoxServiceControlExecAllocateThreadData(PVBOXSERVICECTRLTHREAD pThread,
+                                             uint32_t u32ContextID, 
+                                             const char *pszCmd, uint32_t uFlags, 
+                                             const char *pszArgs, uint32_t uNumArgs,                                           
+                                             const char *pszEnv, uint32_t cbEnv, uint32_t uNumEnvVars,
+                                             const char *pszStdIn, const char *pszStdOut, const char *pszStdErr,
+                                             const char *pszUser, const char *pszPassword, uint32_t uTimeLimitMS)
+{
+    AssertPtr(pThread);
 
     pThread->fShutdown = false;
@@ -593,9 +592,9 @@
                              || (uTimeLimitMS == 0)) ?
                              RT_INDEFINITE_WAIT : uTimeLimitMS;
-    return pThread;
+    return rc;
 }
 
 /** Frees an allocated thread data structure along with all its allocated parameters. */
-void VBoxServiceControlExecDestroyThread(PVBOXSERVICECTRLTHREAD pThread)
+void VBoxServiceControlExecDestroyThreadData(PVBOXSERVICECTRLTHREAD pThread)
 {
     AssertPtr(pThread);
@@ -613,6 +612,4 @@
     RTStrFree(pThread->pszUser);
     RTStrFree(pThread->pszPassword);
-
-    RTMemFree(pThread);
 }
 
@@ -771,42 +768,48 @@
                                   const char *pszUser, const char *pszPassword, uint32_t uTimeLimitMS)
 {
-    PVBOXSERVICECTRLTHREAD pThread = 
-        VBoxServiceControlExecAllocateThreadData(uContextID, 
-                                                 pszCmd, uFlags, 
-                                                 pszArgs, uNumArgs,
-                                                 pszEnv, cbEnv, uNumEnvVars, 
-                                                 pszStdIn, pszStdOut, pszStdErr, 
-                                                 pszUser, pszPassword,
-                                                 uTimeLimitMS);
-    int rc = VINF_SUCCESS;
+    PVBOXSERVICECTRLTHREAD pThread = (PVBOXSERVICECTRLTHREAD)RTMemAlloc(sizeof(VBOXSERVICECTRLTHREAD));
+
+    int rc;
     if (pThread)
     {
-        rc = RTThreadCreate(&pThread->Thread, VBoxServiceControlExecThread, 
-                            (void *)(PVBOXSERVICECTRLTHREAD*)pThread, 0,
-                            RTTHREADTYPE_DEFAULT, RTTHREADFLAGS_WAITABLE, "Exec");
-        if (RT_FAILURE(rc))
-        {
-            VBoxServiceError("Control: RTThreadCreate failed, rc=%Rrc\n, pThread=%p\n", 
-                             rc, pThread);
-        }
-        else
-        {
-            /* Wait for the thread to initialize. */
-            RTThreadUserWait(pThread->Thread, 60 * 1000);
-            if (pThread->fShutdown)
-            {
-                VBoxServiceError("Control: Thread for process \"%s\" failed to start!\n", pszCmd);
-                rc = VERR_GENERAL_FAILURE;
+        rc = VBoxServiceControlExecAllocateThreadData(pThread,
+                                                      uContextID, 
+                                                      pszCmd, uFlags, 
+                                                      pszArgs, uNumArgs,
+                                                      pszEnv, cbEnv, uNumEnvVars, 
+                                                      pszStdIn, pszStdOut, pszStdErr, 
+                                                      pszUser, pszPassword,
+                                                      uTimeLimitMS);
+        if (RT_SUCCESS(rc))
+        {
+            rc = RTThreadCreate(&pThread->Thread, VBoxServiceControlExecThread, 
+                                (void *)(PVBOXSERVICECTRLTHREAD*)pThread, 0,
+                                RTTHREADTYPE_DEFAULT, RTTHREADFLAGS_WAITABLE, "Exec");
+            if (RT_FAILURE(rc))
+            {
+                VBoxServiceError("Control: RTThreadCreate failed, rc=%Rrc\n, pThread=%p\n", 
+                                 rc, pThread);
             }
             else
             {
-                g_GuestControlExecThreads.push_back(pThread);
-            }
-        }
-
-        if (RT_FAILURE(rc))
-        {
-            /* Only destroy thread data on failure; otherwise it's destroyed in the thread handler. */
-            VBoxServiceControlExecDestroyThread(pThread);
+                /* Wait for the thread to initialize. */
+                RTThreadUserWait(pThread->Thread, 60 * 1000);
+                if (pThread->fShutdown)
+                {
+                    VBoxServiceError("Control: Thread for process \"%s\" failed to start!\n", pszCmd);
+                    rc = VERR_GENERAL_FAILURE;
+                }
+                else
+                {
+                    g_GuestControlExecThreads.push_back(pThread);
+                }
+            }
+    
+            if (RT_FAILURE(rc))
+            {
+                /* Only destroy thread data on failure; otherwise it's destroyed in the thread handler. */
+                VBoxServiceControlExecDestroyThreadData(pThread);
+                RTMemFree(pThread);
+            }
         }
     }
Index: /trunk/src/VBox/Additions/common/VBoxService/VBoxServiceInternal.h
===================================================================
--- /trunk/src/VBox/Additions/common/VBoxService/VBoxServiceInternal.h	(revision 28408)
+++ /trunk/src/VBox/Additions/common/VBoxService/VBoxServiceInternal.h	(revision 28409)
@@ -239,5 +239,5 @@
                                          const char *pszStdIn, const char *pszStdOut, const char *pszStdErr,
                                          const char *pszUser, const char *pszPassword, uint32_t uTimeLimitMS);
-extern void VBoxServiceControlExecDestroyThread(PVBOXSERVICECTRLTHREAD pThread);
+extern void VBoxServiceControlExecDestroyThreadData(PVBOXSERVICECTRLTHREAD pThread);
 #endif
 
