Sebastian Lackner : wined3d: Fix double free in geometry_shader_init.

[Alexandre Julliard]

Module: wine
Branch: master
Commit: 9b00f0182bc0afc9a30420163e96f85612486b45
URL:    http://source.winehq.org/git/wine.git/?a=commit;h=9b00f0182bc0afc9a30420163e96f85612486b45

Author: Sebastian Lackner <sebastian at fds-team.de>
Date:   Wed Apr 19 18:55:32 2017 +0200

wined3d: Fix double free in geometry_shader_init.

Signed-off-by: Sebastian Lackner <sebastian at fds-team.de>
Signed-off-by: Henri Verbeet <hverbeet at codeweavers.com>
Signed-off-by: Alexandre Julliard <julliard at winehq.org>

---

 dlls/wined3d/shader.c | 18 ++++++++++--------
 1 file changed, 10 insertions(+), 8 deletions(-)

diff --git a/dlls/wined3d/shader.c b/dlls/wined3d/shader.c
index 3681a8d..7dc276f 100644
--- a/dlls/wined3d/shader.c
+++ b/dlls/wined3d/shader.c
@@ -3433,21 +3433,23 @@ static HRESULT geometry_shader_init(struct wined3d_shader *shader, struct wined3
         const struct wined3d_shader_desc *desc, const struct wined3d_stream_output_desc *so_desc,
         void *parent, const struct wined3d_parent_ops *parent_ops)
 {
+    struct wined3d_stream_output_element *elements = NULL;
     HRESULT hr;
 
+    if (so_desc && !(elements = wined3d_calloc(so_desc->element_count, sizeof(*elements))))
+        return E_OUTOFMEMORY;
+
     if (FAILED(hr = shader_init(shader, device, desc, 0, WINED3D_SHADER_TYPE_GEOMETRY, parent, parent_ops)))
+    {
+        HeapFree(GetProcessHeap(), 0, elements);
         return hr;
+    }
 
     if (so_desc)
     {
-        struct wined3d_stream_output_desc *d = &shader->u.gs.so_desc;
-        *d = *so_desc;
-        if (!(d->elements = wined3d_calloc(so_desc->element_count, sizeof(*d->elements))))
-        {
-            wined3d_cs_destroy_object(shader->device->cs, wined3d_shader_destroy_object, shader);
-            return E_OUTOFMEMORY;
-        }
-        memcpy(d->elements, so_desc->elements, so_desc->element_count * sizeof(*d->elements));
+        shader->u.gs.so_desc = *so_desc;
+        shader->u.gs.so_desc.elements = elements;
+        memcpy(elements, so_desc->elements, so_desc->element_count * sizeof(*elements));
     }
 
     return WINED3D_OK;