From 781ff545cfbdcfd5e91a9308ef6dc7fde8ac032a Mon Sep 17 00:00:00 2001
From: Alexandre Julliard <julliard@winehq.org>
Date: Mon, 20 Jun 2011 14:07:59 +0200
Subject: [PATCH] rpcrt4: Make sure we don't try to free a pointer twice.

---
 dlls/rpcrt4/ndr_stubless.c | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/dlls/rpcrt4/ndr_stubless.c b/dlls/rpcrt4/ndr_stubless.c
index bbc9c191265..c5f30747913 100644
--- a/dlls/rpcrt4/ndr_stubless.c
+++ b/dlls/rpcrt4/ndr_stubless.c
@@ -1241,18 +1241,18 @@ static LONG_PTR *stub_do_args(MIDL_STUB_MESSAGE *pStubMsg,
                         else
                             call_freer(pStubMsg, *(unsigned char **)pArg, pTypeFormat);
                     }
-
-                    if (pParam->param_attributes.IsOut &&
-                        !pParam->param_attributes.IsIn &&
-                        !pParam->param_attributes.IsByValue &&
-                        !pParam->param_attributes.ServerAllocSize)
+                    else if (pParam->param_attributes.ServerAllocSize)
+                    {
+                        HeapFree(GetProcessHeap(), 0, *(void **)pArg);
+                    }
+                    else if (pParam->param_attributes.IsOut &&
+                             !pParam->param_attributes.IsIn &&
+                             !pParam->param_attributes.IsByValue)
                     {
                         if (*pTypeFormat != RPC_FC_BIND_CONTEXT)
                             pStubMsg->pfnFree(*(void **)pArg);
                     }
 
-                    if (pParam->param_attributes.ServerAllocSize)
-                        HeapFree(GetProcessHeap(), 0, *(void **)pArg);
                     break;
                 case STUBLESS_INITOUT:
                     if (!pParam->param_attributes.IsIn &&