Jacek Caban : mshtml: Fixed use after free in HTMLElement_destructor.

[Alexandre Julliard]

Module: wine
Branch: master
Commit: 873619e9bd402e1b77dba81e434abbb08e6bad7d
URL:    http://source.winehq.org/git/wine.git/?a=commit;h=873619e9bd402e1b77dba81e43...

Author: Jacek Caban <jacek(a)codeweavers.com>
Date:   Wed Mar  2 23:10:22 2011 +0100

mshtml: Fixed use after free in HTMLElement_destructor.

---

 dlls/mshtml/htmlelem.c |    5 ++++-
 1 files changed, 4 insertions(+), 1 deletions(-)

diff --git a/dlls/mshtml/htmlelem.c b/dlls/mshtml/htmlelem.c
index c4d5607..bf54739 100644
--- a/dlls/mshtml/htmlelem.c
+++ b/dlls/mshtml/htmlelem.c
@@ -1649,7 +1649,10 @@ void HTMLElement_destructor(HTMLDOMNode *iface)
     HTMLElement *This = impl_from_HTMLDOMNode(iface);
     HTMLDOMAttribute *attr;
 
-    LIST_FOR_EACH_ENTRY(attr, &This->attrs, HTMLDOMAttribute, entry) {
+    while(!list_empty(&This->attrs)) {
+        attr = LIST_ENTRY(list_head(&This->attrs), HTMLDOMAttribute, entry);
+
+        list_remove(&attr->entry);
         attr->elem = NULL;
         IHTMLDOMAttribute_Release(&attr->IHTMLDOMAttribute_iface);
     }