[PATCH] qcap: fixed a use after free in error path (Coverity)

[Marcus Meissner]

CID 714098

in error path we could reuse the freed pointer.
Also set mT[0] to NULL to avoid returning the freed pointer.

Ciao, Marcus
---
 dlls/qcap/v4l.c        |    1 +
 dlls/qcap/vfwcapture.c |    7 ++++---
 2 files changed, 5 insertions(+), 3 deletions(-)

diff --git a/dlls/qcap/v4l.c b/dlls/qcap/v4l.c
index 119eb29..1851ba4 100644
--- a/dlls/qcap/v4l.c
+++ b/dlls/qcap/v4l.c
@@ -314,6 +314,7 @@ HRESULT qcap_driver_get_format(const Capture *capBox, AM_MEDIA_TYPE ** mT)
     if (!vi)
     {
         CoTaskMemFree(mT[0]);
+        mT[0] = NULL;
         return E_OUTOFMEMORY;
     }
     mT[0]->majortype = MEDIATYPE_Video;
diff --git a/dlls/qcap/vfwcapture.c b/dlls/qcap/vfwcapture.c
index 68341ae..7be59cc 100644
--- a/dlls/qcap/vfwcapture.c
+++ b/dlls/qcap/vfwcapture.c
@@ -678,9 +678,10 @@ static HRESULT WINAPI VfwPin_GetMediaType(BasePin *iface, int iPosition, AM_MEDI
         return VFW_S_NO_MORE_ITEMS;
 
     hr = qcap_driver_get_format(This->driver_info, &vfw_pmt);
-    CopyMediaType(pmt, vfw_pmt);
-    DeleteMediaType(vfw_pmt);
-
+    if (SUCCEEDED(hr)) {
+        CopyMediaType(pmt, vfw_pmt);
+        DeleteMediaType(vfw_pmt);
+    }
     return hr;
 }
 
-- 
1.7.3.4