Fabian Maurer : shell32: Prevent user after free in error case (Coverity).

[Alexandre Julliard]

Module: wine
Branch: stable
Commit: e2568dc4096742c6dc87ebae8d444af7f95eba05
URL:    https://gitlab.winehq.org/wine/wine/-/commit/e2568dc4096742c6dc87ebae8d444af...

Author: Fabian Maurer <dark.shadow4(a)web.de>
Date:   Tue Apr 26 21:03:19 2022 +0200

shell32: Prevent user after free in error case (Coverity).

Otherwise when hr is not SUCCEEDED we use array and free it again.

Signed-off-by: Fabian Maurer <dark.shadow4(a)web.de>
Signed-off-by: Nikolay Sivov <nsivov(a)codeweavers.com>
Signed-off-by: Alexandre Julliard <julliard(a)winehq.org>
(cherry picked from commit d98646f915823d3bdf865743bb5b95c00e77cfa7)
Signed-off-by: Michael Stefaniuc <mstefani(a)winehq.org>

---

 dlls/shell32/shellitem.c | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/dlls/shell32/shellitem.c b/dlls/shell32/shellitem.c
index 4693641d6ef..6a5418aebe5 100644
--- a/dlls/shell32/shellitem.c
+++ b/dlls/shell32/shellitem.c
@@ -1402,15 +1402,15 @@ HRESULT WINAPI SHCreateShellItemArrayFromIDLists(UINT cidl,
     if(SUCCEEDED(ret))
     {
         ret = create_shellitemarray(array, cidl, psia);
-        heap_free(array);
-        if(SUCCEEDED(ret))
-            return ret;
     }
 
-    for(i = 0; i < cidl; i++)
-        if(array[i]) IShellItem_Release(array[i]);
+    if(FAILED(ret))
+    {
+        for(i = 0; i < cidl; i++)
+            if(array[i]) IShellItem_Release(array[i]);
+        *psia = NULL;
+    }
     heap_free(array);
-    *psia = NULL;
     return ret;
 }