crypt32: Avoid double free in CRYPT_LoadSIP on error path (coverity))

Frédéric Delanoy frederic.delanoy at gmail.com
Mon Oct 29 03:33:19 CDT 2012


FreeLibrary(temp) can be called twice on error.

CID 714004
---
 dlls/crypt32/sip.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/dlls/crypt32/sip.c b/dlls/crypt32/sip.c
index e43ebc7..fa384be 100644
--- a/dlls/crypt32/sip.c
+++ b/dlls/crypt32/sip.c
@@ -634,14 +634,17 @@ static BOOL CRYPT_LoadSIP(const GUID *pgSubject)
     if (!sip.pfPut || temp != lib)
         goto error;
     FreeLibrary(temp);
+    temp = NULL;
     sip.pfCreate = CRYPT_LoadSIPFunc(pgSubject, szCreate, &temp);
     if (!sip.pfCreate || temp != lib)
         goto error;
     FreeLibrary(temp);
+    temp = NULL;
     sip.pfVerify = CRYPT_LoadSIPFunc(pgSubject, szVerify, &temp);
     if (!sip.pfVerify || temp != lib)
         goto error;
     FreeLibrary(temp);
+    temp = NULL;
     sip.pfRemove = CRYPT_LoadSIPFunc(pgSubject, szRemoveSigned, &temp);
     if (!sip.pfRemove || temp != lib)
         goto error;
@@ -652,7 +655,7 @@ static BOOL CRYPT_LoadSIP(const GUID *pgSubject)
 
 error:
     FreeLibrary(lib);
-    FreeLibrary(temp);
+    if (temp != NULL) FreeLibrary(temp);
     SetLastError(TRUST_E_SUBJECT_FORM_UNKNOWN);
     return FALSE;
 }
-- 
1.8.0




More information about the wine-patches mailing list