Fabian Maurer : shell32: Prevent user after free in error case (Coverity).
Alexandre Julliard
julliard at winehq.org
Tue May 3 15:39:26 CDT 2022
Module: wine
Branch: master
Commit: d98646f915823d3bdf865743bb5b95c00e77cfa7
URL: https://source.winehq.org/git/wine.git/?a=commit;h=d98646f915823d3bdf865743bb5b95c00e77cfa7
Author: Fabian Maurer <dark.shadow4 at web.de>
Date: Tue Apr 26 21:03:19 2022 +0200
shell32: Prevent user after free in error case (Coverity).
Otherwise when hr is not SUCCEEDED we use array and free it again.
Signed-off-by: Fabian Maurer <dark.shadow4 at web.de>
Signed-off-by: Nikolay Sivov <nsivov at codeweavers.com>
Signed-off-by: Alexandre Julliard <julliard at winehq.org>
---
dlls/shell32/shellitem.c | 12 ++++++------
1 file changed, 6 insertions(+), 6 deletions(-)
diff --git a/dlls/shell32/shellitem.c b/dlls/shell32/shellitem.c
index 0381fa67f0d..ada98705483 100644
--- a/dlls/shell32/shellitem.c
+++ b/dlls/shell32/shellitem.c
@@ -1452,15 +1452,15 @@ HRESULT WINAPI SHCreateShellItemArrayFromIDLists(UINT cidl,
if(SUCCEEDED(ret))
{
ret = create_shellitemarray(array, cidl, psia);
- heap_free(array);
- if(SUCCEEDED(ret))
- return ret;
}
- for(i = 0; i < cidl; i++)
- if(array[i]) IShellItem_Release(array[i]);
+ if(FAILED(ret))
+ {
+ for(i = 0; i < cidl; i++)
+ if(array[i]) IShellItem_Release(array[i]);
+ *psia = NULL;
+ }
heap_free(array);
- *psia = NULL;
return ret;
}
More information about the wine-cvs
mailing list