Aleksey Bragin : msi: Fix freed memory access and fix freeing of invalid pointer.

[Alexandre Julliard]

Module: wine
Branch: stable
Commit: 516616bf8e7755aa797aa1e4ce9a0e0bbe4f6f15
URL:    http://source.winehq.org/git/wine.git/?a=commit;h=516616bf8e7755aa797aa1e4ce...

Author: Aleksey Bragin <aleksey(a)reactos.org>
Date:   Fri Oct 22 20:08:58 2010 +0400

msi: Fix freed memory access and fix freeing of invalid pointer.
(cherry picked from commit 8c5718ec9d0613be7208e1ceaecac0e7434c4cf5)

---

 dlls/msi/action.c |    7 +++++--
 1 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/dlls/msi/action.c b/dlls/msi/action.c
index 7ae8286..eeb349b 100644
--- a/dlls/msi/action.c
+++ b/dlls/msi/action.c
@@ -1967,7 +1967,7 @@ static UINT ITERATE_CostFinalizeConditions(MSIRECORD *row, LPVOID param)
 VS_FIXEDFILEINFO *msi_get_disk_file_version( LPCWSTR filename )
 {
     static const WCHAR name[] = {'\\',0};
-    VS_FIXEDFILEINFO *ret;
+    VS_FIXEDFILEINFO *ptr, *ret;
     LPVOID version;
     DWORD versize, handle;
     UINT sz;
@@ -1984,12 +1984,15 @@ VS_FIXEDFILEINFO *msi_get_disk_file_version( LPCWSTR filename )
 
     GetFileVersionInfoW( filename, 0, versize, version );
 
-    if (!VerQueryValueW( version, name, (LPVOID *)&ret, &sz ))
+    if (!VerQueryValueW( version, name, (LPVOID *)&ptr, &sz ))
     {
         msi_free( version );
         return NULL;
     }
 
+    ret = msi_alloc( sz );
+    memcpy( ret, ptr, sz );
+
     msi_free( version );
     return ret;
 }