ReceiveTempSMS
/
Sweden-Number
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

riched20: Fix a use after free. 

In ME_DestroyEditor(), the item list is being freed when
calling get_total_width() in destroy_para().

Wine-Bug: https://bugs.winehq.org/show_bug.cgi?id=46328
Signed-off-by: Zhiyi Zhang <zzhang@codeweavers.com>
Signed-off-by: Huw Davies <huw@codeweavers.com>
Signed-off-by: Alexandre Julliard <julliard@winehq.org>
This commit is contained in:
Zhiyi Zhang 2019-01-02 00:03:29 +08:00 committed by Alexandre Julliard
parent d3ca7db42e
commit 62d80cff69
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
dlls/riched20/editor.c
View File

@ -3183,13 +3183,13 @@ ME_TextEditor *ME_MakeEditor(ITextHost *texthost, BOOL bEmulateVersion10)
void ME_DestroyEditor(ME_TextEditor *editor)
{
ME_DisplayItem *pFirst = editor->pBuffer->pFirst;
ME_DisplayItem *p = pFirst, *pNext = NULL;
ME_DisplayItem *p = editor->pBuffer->pFirst, *pNext = NULL;
ME_Style *s, *cursor2;
int i;
ME_ClearTempStyle(editor);
ME_EmptyUndoStack(editor);
editor->pBuffer->pFirst = NULL;
while(p) {
pNext = p->next;
if (p->type == diParagraph)