msi: Fix another double free.
parser_alloc() allocates memory and puts it on a list attached the to query object. EXPR_sval() frees memory allocated via parser_alloc() on error but does not remove the pointer from the list, which means that when the query destructor is called it will be freed again.
This commit is contained in:
parent
91ac47b84b
commit
55ad3fdda2
|
@ -876,10 +876,7 @@ static struct expr * EXPR_sval( void *info, const struct sql_str *str )
|
||||||
{
|
{
|
||||||
e->type = EXPR_SVAL;
|
e->type = EXPR_SVAL;
|
||||||
if( SQL_getstring( info, str, (LPWSTR *)&e->u.sval ) != ERROR_SUCCESS )
|
if( SQL_getstring( info, str, (LPWSTR *)&e->u.sval ) != ERROR_SUCCESS )
|
||||||
{
|
return NULL; /* e will be freed by query destructor */
|
||||||
msi_free( e );
|
|
||||||
return NULL;
|
|
||||||
}
|
|
||||||
}
|
}
|
||||||
return e;
|
return e;
|
||||||
}
|
}
|
||||||
|
|
Loading…
Reference in New Issue