[PATCH 4/7] shell32: Prevent user after free in error case (Coverity)

Fabian Maurer dark.shadow4 at web.de
Sat Apr 23 13:17:26 CDT 2022


Otherwise when hr is not SUCCEEDED we use array and free it again.

Signed-off-by: Fabian Maurer <dark.shadow4 at web.de>
---
 dlls/shell32/shellitem.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/dlls/shell32/shellitem.c b/dlls/shell32/shellitem.c
index 0a3a76cbd6a..8568ec34a83 100644
--- a/dlls/shell32/shellitem.c
+++ b/dlls/shell32/shellitem.c
@@ -1402,9 +1402,11 @@ HRESULT WINAPI SHCreateShellItemArrayFromIDLists(UINT cidl,
     if(SUCCEEDED(ret))
     {
         ret = create_shellitemarray(array, cidl, psia);
-        heap_free(array);
         if(SUCCEEDED(ret))
+        {
+            heap_free(array);
             return ret;
+        }
     }

     for(i = 0; i < cidl; i++)
--
2.36.0




More information about the wine-devel mailing list