ReceiveTempSMS
/
Sweden-Number
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

richedit: Prevented a dereference of a freed pointer. 

On WM_DESTROY the editor was getting freed, then it was used to obtain
a handle to the editor.  This patch moves it just before the editor is
freed within ME_DestroyEditor.
This commit is contained in:
Dylan Smith 2008-12-27 00:06:40 -05:00 committed by Alexandre Julliard
parent a8a97091fe
commit c9977df853
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
dlls/riched20/editor.c
View File

@ -2685,6 +2685,7 @@ void ME_DestroyEditor(ME_TextEditor *editor)
DeleteObject(editor->hbrBackground); DeleteObject(editor->hbrBackground);
if(editor->lpOleCallback) if(editor->lpOleCallback)
IUnknown_Release(editor->lpOleCallback); IUnknown_Release(editor->lpOleCallback);
SetWindowLongPtrW(editor->hWnd, 0, 0);
OleUninitialize(); OleUninitialize();
FREE_OBJ(editor->pBuffer); FREE_OBJ(editor->pBuffer);
@ -3821,7 +3822,6 @@ LRESULT ME_HandleMessage(ME_TextEditor *editor, UINT msg, WPARAM wParam,
} }
case WM_DESTROY: case WM_DESTROY:
ME_DestroyEditor(editor); ME_DestroyEditor(editor);
SetWindowLongPtrW(editor->hWnd, 0, 0);
return 0; return 0;
case WM_SETCURSOR: case WM_SETCURSOR:
{ {