From bce23d7edbc83e5a5170f2f9d46fbb801c8750d7 Mon Sep 17 00:00:00 2001
From: Huw Davies <huw@codeweavers.com>
Date: Mon, 21 Jul 2008 11:15:49 +0100
Subject: [PATCH] user32: Don't access pConv after it's been freed.

---
 dlls/user32/dde_misc.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/dlls/user32/dde_misc.c b/dlls/user32/dde_misc.c
index 049deaee685..d99cdcf746f 100644
--- a/dlls/user32/dde_misc.c
+++ b/dlls/user32/dde_misc.c
@@ -1658,9 +1658,10 @@ void WDML_RemoveServer(WDML_INSTANCE* pInstance, HSZ hszService, HSZ hszTopic)
 		pConvNext = pConv->next;
 		if (DdeCmpStringHandles(pConv->hszService, hszService) == 0)
 		{
+                    HWND client = pConv->hwndClient, server = pConv->hwndServer;
 		    WDML_RemoveConv(pConv, WDML_SERVER_SIDE);
 		    /* don't care about return code (whether client window is present or not) */
-		    PostMessageW(pConv->hwndClient, WM_DDE_TERMINATE, (WPARAM)pConv->hwndServer, 0);
+		    PostMessageW(client, WM_DDE_TERMINATE, (WPARAM)server, 0);
 		}
 	    }
 	    if (pServer == pInstance->servers)