From d6ce0b10c41b5c59f26c03891144af0338acf8cf Mon Sep 17 00:00:00 2001
From: Huw Davies <huw@codeweavers.com>
Date: Tue, 3 May 2011 12:07:02 +0100
Subject: [PATCH] shell32: Always clone the return pidl to avoid a double free
 if the selection is changed during teardown.

---
 dlls/shell32/brsfolder.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/dlls/shell32/brsfolder.c b/dlls/shell32/brsfolder.c
index 3824c4e806a..b97a7539327 100644
--- a/dlls/shell32/brsfolder.c
+++ b/dlls/shell32/brsfolder.c
@@ -558,7 +558,8 @@ static HRESULT BrsFolder_Treeview_Changed( browse_info *info, NMTREEVIEWW *pnmtv
     LPTV_ITEMDATA lptvid = (LPTV_ITEMDATA) pnmtv->itemNew.lParam;
 
     lptvid = (LPTV_ITEMDATA) pnmtv->itemNew.lParam;
-    info->pidlRet = lptvid->lpifq;
+    ILFree(info->pidlRet);
+    info->pidlRet = ILClone(lptvid->lpifq);
     browsefolder_callback( info->lpBrowseInfo, info->hWnd, BFFM_SELCHANGED,
                            (LPARAM)info->pidlRet );
     BrsFolder_CheckValidSelection( info, lptvid );
@@ -676,8 +677,6 @@ static BOOL BrsFolder_OnCommand( browse_info *info, UINT id )
     switch (id)
     {
     case IDOK:
-        /* The original pidl is owned by the treeview and will be free'd. */
-        info->pidlRet = ILClone(info->pidlRet);
         if (info->pidlRet == NULL) /* A null pidl would mean a cancel */
             info->pidlRet = _ILCreateDesktop();
         pdump( info->pidlRet );
@@ -982,7 +981,10 @@ LPITEMIDLIST WINAPI SHBrowseForFolderW (LPBROWSEINFOW lpbi)
     if (SUCCEEDED(hr)) 
         OleUninitialize();
     if (!r)
+    {
+        ILFree(info.pidlRet);
         return NULL;
+    }
 
     return info.pidlRet;
 }