Aleksey Bragin : msi: Fix freed memory access and fix freeing of invalid pointer.

[Alexandre Julliard]

Module: wine
Branch: master
Commit: 8c5718ec9d0613be7208e1ceaecac0e7434c4cf5
URL:    http://source.winehq.org/git/wine.git/?a=commit;h=8c5718ec9d0613be7208e1ceaecac0e7434c4cf5

Author: Aleksey Bragin <aleksey at reactos.org>
Date:   Fri Oct 22 20:08:58 2010 +0400

msi: Fix freed memory access and fix freeing of invalid pointer.

---

 dlls/msi/action.c |    7 +++++--
 1 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/dlls/msi/action.c b/dlls/msi/action.c
index a8e3a5d..3ebf286 100644
--- a/dlls/msi/action.c
+++ b/dlls/msi/action.c
@@ -2083,7 +2083,7 @@ static UINT ITERATE_CostFinalizeConditions(MSIRECORD *row, LPVOID param)
 VS_FIXEDFILEINFO *msi_get_disk_file_version( LPCWSTR filename )
 {
     static const WCHAR name[] = {'\\',0};
-    VS_FIXEDFILEINFO *ret;
+    VS_FIXEDFILEINFO *ptr, *ret;
     LPVOID version;
     DWORD versize, handle;
     UINT sz;
@@ -2100,12 +2100,15 @@ VS_FIXEDFILEINFO *msi_get_disk_file_version( LPCWSTR filename )
 
     GetFileVersionInfoW( filename, 0, versize, version );
 
-    if (!VerQueryValueW( version, name, (LPVOID *)&ret, &sz ))
+    if (!VerQueryValueW( version, name, (LPVOID *)&ptr, &sz ))
     {
         msi_free( version );
         return NULL;
     }
 
+    ret = msi_alloc( sz );
+    memcpy( ret, ptr, sz );
+
     msi_free( version );
     return ret;
 }