[PATCH 0/1] MR1656: user32: Avoid freeing invalid pointers in WIN_CreateWindowEx.

[Rémi Bernon]

When `lpszName` is NULL or when it is a resource ID we are possibly freeing uninitialized or stack pointer.

-- 
https://gitlab.winehq.org/wine/wine/-/merge_requests/1656

[PATCH 1/1] user32: Avoid freeing invalid pointers in WIN_CreateWindowEx.

[Rémi Bernon]

From: Rémi Bernon <rbernon(a)codeweavers.com>

---
 dlls/user32/win.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/dlls/user32/win.c b/dlls/user32/win.c
index a6f43c188c4..d8869b2b9db 100644
--- a/dlls/user32/win.c
+++ b/dlls/user32/win.c
@@ -278,7 +278,7 @@ static BOOL is_default_coord( int x )
  */
 HWND WIN_CreateWindowEx( CREATESTRUCTW *cs, LPCWSTR className, HINSTANCE module, BOOL unicode )
 {
-    UNICODE_STRING class, window_name;
+    UNICODE_STRING class, window_name = {0};
     HWND hwnd, top_child = 0;
     MDICREATESTRUCTW mdi_cs;
     WNDCLASSEXW info;
@@ -401,7 +401,7 @@ HWND WIN_CreateWindowEx( CREATESTRUCTW *cs, LPCWSTR className, HINSTANCE module,
                                  cs->x, cs->y, cs->cx, cs->cy, cs->hwndParent, menu, module,
                                  cs->lpCreateParams, 0, NULL, 0, !unicode );
     if (!hwnd && menu && menu != cs->hMenu) NtUserDestroyMenu( menu );
-    if (!unicode) RtlFreeUnicodeString( &window_name );
+    if (!unicode && window_name.Buffer != name_buf) RtlFreeUnicodeString( &window_name );
     return hwnd;
 }
 
-- 
GitLab

https://gitlab.winehq.org/wine/wine/-/merge_requests/1656