Marcus Meissner : user32: Fixed two use-after-free (Coverity).
Alexandre Julliard
julliard at winehq.org
Mon Aug 20 14:16:17 CDT 2012
Module: wine
Branch: master
Commit: 84bb5969120d605ec0f6bbe458851cba4670edaa
URL: http://source.winehq.org/git/wine.git/?a=commit;h=84bb5969120d605ec0f6bbe458851cba4670edaa
Author: Marcus Meissner <marcus at jet.franken.de>
Date: Fri Aug 17 21:31:34 2012 +0200
user32: Fixed two use-after-free (Coverity).
---
dlls/user32/dde_client.c | 15 +++++++++++----
1 files changed, 11 insertions(+), 4 deletions(-)
diff --git a/dlls/user32/dde_client.c b/dlls/user32/dde_client.c
index ef3ee3f..90fa4db 100644
--- a/dlls/user32/dde_client.c
+++ b/dlls/user32/dde_client.c
@@ -1246,14 +1246,18 @@ BOOL WINAPI DdeAbandonTransaction(DWORD idInst, HCONV hConv, DWORD idTransaction
{
if ((pConv = WDML_GetConv(hConv, TRUE)) && pConv->instance == pInstance)
{
- for (pXAct = pConv->transactions; pXAct; pXAct = pXAct->next)
- {
+
+ pXAct = pConv->transactions;
+ while (pXAct) {
+ WDML_XACT *nextXAct = pXAct->next;
+
if (pXAct->dwTimeout == TIMEOUT_ASYNC &&
(idTransaction == 0 || pXAct->xActID == idTransaction))
{
WDML_UnQueueTransaction(pConv, pXAct);
WDML_FreeTransaction(pInstance, pXAct, TRUE);
}
+ pXAct = nextXAct;
}
}
}
@@ -1262,13 +1266,16 @@ BOOL WINAPI DdeAbandonTransaction(DWORD idInst, HCONV hConv, DWORD idTransaction
for (pConv = pInstance->convs[WDML_CLIENT_SIDE]; pConv; pConv = pConv->next)
{
if (!(pConv->wStatus & ST_CONNECTED)) continue;
- for (pXAct = pConv->transactions; pXAct; pXAct = pXAct->next)
- {
+ pXAct = pConv->transactions;
+ while (pXAct) {
+ WDML_XACT *nextXAct = pXAct->next;
+
if (pXAct->dwTimeout == TIMEOUT_ASYNC)
{
WDML_UnQueueTransaction(pConv, pXAct);
WDML_FreeTransaction(pInstance, pXAct, TRUE);
}
+ pXAct = nextXAct;
}
}
}
More information about the wine-cvs
mailing list