Fabian Maurer : shell32: Prevent user after free in error case (Coverity).

[Alexandre Julliard]

Module: wine
Branch: master
Commit: d98646f915823d3bdf865743bb5b95c00e77cfa7
URL:    https://source.winehq.org/git/wine.git/?a=commit;h=d98646f915823d3bdf865743b...

Author: Fabian Maurer <dark.shadow4(a)web.de>
Date:   Tue Apr 26 21:03:19 2022 +0200

shell32: Prevent user after free in error case (Coverity).

Otherwise when hr is not SUCCEEDED we use array and free it again.

Signed-off-by: Fabian Maurer <dark.shadow4(a)web.de>
Signed-off-by: Nikolay Sivov <nsivov(a)codeweavers.com>
Signed-off-by: Alexandre Julliard <julliard(a)winehq.org>

---

 dlls/shell32/shellitem.c | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/dlls/shell32/shellitem.c b/dlls/shell32/shellitem.c
index 0381fa67f0d..ada98705483 100644
--- a/dlls/shell32/shellitem.c
+++ b/dlls/shell32/shellitem.c
@@ -1452,15 +1452,15 @@ HRESULT WINAPI SHCreateShellItemArrayFromIDLists(UINT cidl,
     if(SUCCEEDED(ret))
     {
         ret = create_shellitemarray(array, cidl, psia);
-        heap_free(array);
-        if(SUCCEEDED(ret))
-            return ret;
     }
 
-    for(i = 0; i < cidl; i++)
-        if(array[i]) IShellItem_Release(array[i]);
+    if(FAILED(ret))
+    {
+        for(i = 0; i < cidl; i++)
+            if(array[i]) IShellItem_Release(array[i]);
+        *psia = NULL;
+    }
     heap_free(array);
-    *psia = NULL;
     return ret;
 }