winmm: Don't operate on free'd data in timer

[Maarten Lankhorst]

-------------- next part --------------
>From 2bdcb178b659b201d78dd9ee0227f7a73d64a84c Mon Sep 17 00:00:00 2001
From: Maarten Lankhorst <m.b.lankhorst at gmail.com>
Date: Thu, 19 Jul 2007 11:34:48 +0200
Subject: [PATCH] winmm: Don't operate on free()'d data in the timer

---
 dlls/winmm/time.c |    6 ++++--
 1 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/dlls/winmm/time.c b/dlls/winmm/time.c
index 827f87a..2092540 100644
--- a/dlls/winmm/time.c
+++ b/dlls/winmm/time.c
@@ -359,6 +359,7 @@ MMRESULT WINAPI timeSetEvent(UINT wDelay, UINT wResol, LPTIMECALLBACK lpFunc,
 MMRESULT WINAPI timeKillEvent(UINT wID)
 {
     WINE_TIMERENTRY *lpSelf = NULL, *lpTimer;
+    DWORD wFlags;
 
     TRACE("(%u)\n", wID);
     EnterCriticalSection(&WINMM_cs);
@@ -378,10 +379,11 @@ MMRESULT WINAPI timeKillEvent(UINT wID)
         WARN("wID=%u is not a valid timer ID\n", wID);
         return MMSYSERR_INVALPARAM;
     }
-    if (lpSelf->wFlags & TIME_KILL_SYNCHRONOUS)
+    wFlags = lpSelf->wFlags;
+    if (wFlags & TIME_KILL_SYNCHRONOUS)
         EnterCriticalSection(&TIME_cbcrst);
     HeapFree(GetProcessHeap(), 0, lpSelf);
-    if (lpSelf->wFlags & TIME_KILL_SYNCHRONOUS)
+    if (wFlags & TIME_KILL_SYNCHRONOUS)
         LeaveCriticalSection(&TIME_cbcrst);
     return TIMERR_NOERROR;
 }
-- 
1.4.4.2