Maarten Lankhorst : winmm: Don't operate on freed data in timer.

[Alexandre Julliard]

Module: wine
Branch: master
Commit: 93b6f158263772493c6ebb712bbf2e96427e4474
URL:    http://source.winehq.org/git/wine.git/?a=commit;h=93b6f158263772493c6ebb712bbf2e96427e4474

Author: Maarten Lankhorst <m.b.lankhorst at gmail.com>
Date:   Thu Jul 19 11:34:48 2007 +0200

winmm: Don't operate on freed data in timer.

---

 dlls/winmm/time.c |    6 ++++--
 1 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/dlls/winmm/time.c b/dlls/winmm/time.c
index 827f87a..2092540 100644
--- a/dlls/winmm/time.c
+++ b/dlls/winmm/time.c
@@ -359,6 +359,7 @@ MMRESULT WINAPI timeSetEvent(UINT wDelay, UINT wResol, LPTIMECALLBACK lpFunc,
 MMRESULT WINAPI timeKillEvent(UINT wID)
 {
     WINE_TIMERENTRY *lpSelf = NULL, *lpTimer;
+    DWORD wFlags;
 
     TRACE("(%u)\n", wID);
     EnterCriticalSection(&WINMM_cs);
@@ -378,10 +379,11 @@ MMRESULT WINAPI timeKillEvent(UINT wID)
         WARN("wID=%u is not a valid timer ID\n", wID);
         return MMSYSERR_INVALPARAM;
     }
-    if (lpSelf->wFlags & TIME_KILL_SYNCHRONOUS)
+    wFlags = lpSelf->wFlags;
+    if (wFlags & TIME_KILL_SYNCHRONOUS)
         EnterCriticalSection(&TIME_cbcrst);
     HeapFree(GetProcessHeap(), 0, lpSelf);
-    if (lpSelf->wFlags & TIME_KILL_SYNCHRONOUS)
+    if (wFlags & TIME_KILL_SYNCHRONOUS)
         LeaveCriticalSection(&TIME_cbcrst);
     return TIMERR_NOERROR;
 }