From d98646f915823d3bdf865743bb5b95c00e77cfa7 Mon Sep 17 00:00:00 2001 From: Fabian Maurer Date: Tue, 26 Apr 2022 21:03:19 +0200 Subject: [PATCH] shell32: Prevent user after free in error case (Coverity). Otherwise when hr is not SUCCEEDED we use array and free it again. Signed-off-by: Fabian Maurer Signed-off-by: Nikolay Sivov Signed-off-by: Alexandre Julliard --- dlls/shell32/shellitem.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/dlls/shell32/shellitem.c b/dlls/shell32/shellitem.c index 0381fa67f0d..ada98705483 100644 --- a/dlls/shell32/shellitem.c +++ b/dlls/shell32/shellitem.c @@ -1452,15 +1452,15 @@ HRESULT WINAPI SHCreateShellItemArrayFromIDLists(UINT cidl, if(SUCCEEDED(ret)) { ret = create_shellitemarray(array, cidl, psia); - heap_free(array); - if(SUCCEEDED(ret)) - return ret; } - for(i = 0; i < cidl; i++) - if(array[i]) IShellItem_Release(array[i]); + if(FAILED(ret)) + { + for(i = 0; i < cidl; i++) + if(array[i]) IShellItem_Release(array[i]); + *psia = NULL; + } heap_free(array); - *psia = NULL; return ret; }