Dylan Smith : richedit: Prevented a dereference of a freed pointer.

[Alexandre Julliard]

Module: wine
Branch: master
Commit: c9977df85306f0403c7eeeee7fd041d9b3ac88f8
URL:    http://source.winehq.org/git/wine.git/?a=commit;h=c9977df85306f0403c7eeeee7f...

Author: Dylan Smith <dylan.ah.smith(a)gmail.com>
Date:   Sat Dec 27 00:06:40 2008 -0500

richedit: Prevented a dereference of a freed pointer.

On WM_DESTROY the editor was getting freed, then it was used to obtain
a handle to the editor.  This patch moves it just before the editor is
freed within ME_DestroyEditor.

---

 dlls/riched20/editor.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/dlls/riched20/editor.c b/dlls/riched20/editor.c
index c93a1e4..b5a69f7 100644
--- a/dlls/riched20/editor.c
+++ b/dlls/riched20/editor.c
@@ -2685,6 +2685,7 @@ void ME_DestroyEditor(ME_TextEditor *editor)
     DeleteObject(editor->hbrBackground);
   if(editor->lpOleCallback)
     IUnknown_Release(editor->lpOleCallback);
+  SetWindowLongPtrW(editor->hWnd, 0, 0);
   OleUninitialize();
 
   FREE_OBJ(editor->pBuffer);
@@ -3821,7 +3822,6 @@ LRESULT ME_HandleMessage(ME_TextEditor *editor, UINT msg, WPARAM wParam,
   }
   case WM_DESTROY:
     ME_DestroyEditor(editor);
-    SetWindowLongPtrW(editor->hWnd, 0, 0);
     return 0;
   case WM_SETCURSOR:
   {