Jason Millard : vbscript: Fix memory leak in owned safearray iterator.

[Alexandre Julliard]

Module: wine
Branch: stable
Commit: a6d75af391592b75d8f25ff95baef6ee31284d79
URL:    https://gitlab.winehq.org/wine/wine/-/commit/a6d75af391592b75d8f25ff95baef6e...

Author: Jason Millard <jsm174(a)gmail.com>
Date:   Thu Feb  9 13:11:56 2023 -0500

vbscript: Fix memory leak in owned safearray iterator.

(cherry picked from commit a8c319cad691a53cfd333ab72dbbeac4558f7c75)

---

 dlls/vbscript/interp.c   | 2 +-
 dlls/vbscript/utils.c    | 9 +++++++--
 dlls/vbscript/vbscript.h | 2 +-
 3 files changed, 9 insertions(+), 4 deletions(-)

diff --git a/dlls/vbscript/interp.c b/dlls/vbscript/interp.c
index b3be3bea6cf..12b7af4aef9 100644
--- a/dlls/vbscript/interp.c
+++ b/dlls/vbscript/interp.c
@@ -1480,7 +1480,7 @@ static HRESULT interp_newenum(exec_ctx_t *ctx)
     case VT_VARIANT|VT_ARRAY|VT_BYREF: {
         IEnumVARIANT *iter;
 
-        hres = create_safearray_iter(V_ISBYREF(v.v) ? *V_ARRAYREF(v.v) : V_ARRAY(v.v), &iter);
+        hres = create_safearray_iter(V_ISBYREF(v.v) ? *V_ARRAYREF(v.v) : V_ARRAY(v.v), v.owned && !V_ISBYREF(v.v), &iter);
         if(FAILED(hres))
             return hres;
 
diff --git a/dlls/vbscript/utils.c b/dlls/vbscript/utils.c
index 03b1abde481..4bfc2c65a0a 100644
--- a/dlls/vbscript/utils.c
+++ b/dlls/vbscript/utils.c
@@ -28,6 +28,7 @@ typedef struct {
     LONG ref;
 
     SAFEARRAY *sa;
+    BOOL owned;
     ULONG i, size;
 } safearray_iter;
 
@@ -75,8 +76,11 @@ static ULONG WINAPI safearray_iter_IEnumVARIANT_Release(IEnumVARIANT *iface)
     TRACE("(%p) ref=%ld\n", iface, ref);
 
     if(!ref) {
-        if(This->sa)
+        if(This->sa) {
             SafeArrayUnlock(This->sa);
+            if(This->owned)
+                SafeArrayDestroy(This->sa);
+	}
         free(This);
     }
 
@@ -160,7 +164,7 @@ static ULONG get_safearray_size(SAFEARRAY *sa)
     return ret;
 }
 
-HRESULT create_safearray_iter(SAFEARRAY *sa, IEnumVARIANT **ev)
+HRESULT create_safearray_iter(SAFEARRAY *sa, BOOL owned, IEnumVARIANT **ev)
 {
     safearray_iter *iter;
     HRESULT hres;
@@ -185,6 +189,7 @@ HRESULT create_safearray_iter(SAFEARRAY *sa, IEnumVARIANT **ev)
     iter->IEnumVARIANT_iface.lpVtbl = &safearray_iter_EnumVARIANTVtbl;
     iter->ref = 1;
     iter->sa = sa;
+    iter->owned = owned;
     iter->i = 0;
     iter->size = get_safearray_size(sa);
 
diff --git a/dlls/vbscript/vbscript.h b/dlls/vbscript/vbscript.h
index 8286b37bbab..dca8fb5061a 100644
--- a/dlls/vbscript/vbscript.h
+++ b/dlls/vbscript/vbscript.h
@@ -404,7 +404,7 @@ BSTR string_replace(BSTR,BSTR,BSTR,int,int,int) DECLSPEC_HIDDEN;
 
 void map_vbs_exception(EXCEPINFO *) DECLSPEC_HIDDEN;
 
-HRESULT create_safearray_iter(SAFEARRAY *sa, IEnumVARIANT **ev) DECLSPEC_HIDDEN;
+HRESULT create_safearray_iter(SAFEARRAY *sa, BOOL owned, IEnumVARIANT **ev) DECLSPEC_HIDDEN;
 
 #define FACILITY_VBS 0xa
 #define MAKE_VBSERROR(code) MAKE_HRESULT(SEVERITY_ERROR, FACILITY_VBS, code)