From 873619e9bd402e1b77dba81e434abbb08e6bad7d Mon Sep 17 00:00:00 2001 From: Jacek Caban Date: Wed, 2 Mar 2011 23:10:22 +0100 Subject: [PATCH] mshtml: Fixed use after free in HTMLElement_destructor. --- dlls/mshtml/htmlelem.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/dlls/mshtml/htmlelem.c b/dlls/mshtml/htmlelem.c index c4d56078fea..bf547390518 100644 --- a/dlls/mshtml/htmlelem.c +++ b/dlls/mshtml/htmlelem.c @@ -1649,7 +1649,10 @@ void HTMLElement_destructor(HTMLDOMNode *iface) HTMLElement *This = impl_from_HTMLDOMNode(iface); HTMLDOMAttribute *attr; - LIST_FOR_EACH_ENTRY(attr, &This->attrs, HTMLDOMAttribute, entry) { + while(!list_empty(&This->attrs)) { + attr = LIST_ENTRY(list_head(&This->attrs), HTMLDOMAttribute, entry); + + list_remove(&attr->entry); attr->elem = NULL; IHTMLDOMAttribute_Release(&attr->IHTMLDOMAttribute_iface); }