Huw Davies : shell32: Always clone the return pidl to avoid a double free if the selection is changed during teardown .

[Alexandre Julliard]

Module: wine
Branch: master
Commit: d6ce0b10c41b5c59f26c03891144af0338acf8cf
URL:    http://source.winehq.org/git/wine.git/?a=commit;h=d6ce0b10c41b5c59f26c038911...

Author: Huw Davies <huw(a)codeweavers.com>
Date:   Tue May  3 12:07:02 2011 +0100

shell32: Always clone the return pidl to avoid a double free if the selection is changed during teardown.

---

 dlls/shell32/brsfolder.c |    8 +++++---
 1 files changed, 5 insertions(+), 3 deletions(-)

diff --git a/dlls/shell32/brsfolder.c b/dlls/shell32/brsfolder.c
index 3824c4e..b97a753 100644
--- a/dlls/shell32/brsfolder.c
+++ b/dlls/shell32/brsfolder.c
@@ -558,7 +558,8 @@ static HRESULT BrsFolder_Treeview_Changed( browse_info *info, NMTREEVIEWW *pnmtv
     LPTV_ITEMDATA lptvid = (LPTV_ITEMDATA) pnmtv->itemNew.lParam;
 
     lptvid = (LPTV_ITEMDATA) pnmtv->itemNew.lParam;
-    info->pidlRet = lptvid->lpifq;
+    ILFree(info->pidlRet);
+    info->pidlRet = ILClone(lptvid->lpifq);
     browsefolder_callback( info->lpBrowseInfo, info->hWnd, BFFM_SELCHANGED,
                            (LPARAM)info->pidlRet );
     BrsFolder_CheckValidSelection( info, lptvid );
@@ -676,8 +677,6 @@ static BOOL BrsFolder_OnCommand( browse_info *info, UINT id )
     switch (id)
     {
     case IDOK:
-        /* The original pidl is owned by the treeview and will be free'd. */
-        info->pidlRet = ILClone(info->pidlRet);
         if (info->pidlRet == NULL) /* A null pidl would mean a cancel */
             info->pidlRet = _ILCreateDesktop();
         pdump( info->pidlRet );
@@ -982,7 +981,10 @@ LPITEMIDLIST WINAPI SHBrowseForFolderW (LPBROWSEINFOW lpbi)
     if (SUCCEEDED(hr)) 
         OleUninitialize();
     if (!r)
+    {
+        ILFree(info.pidlRet);
         return NULL;
+    }
 
     return info.pidlRet;
 }