[PATCH 0/1] MR3097: sane: Fix use after free in create_item (scan-build).

[Alex Henrie (＠alexhenrie)]

realloc may free lead_static.

-- 
https://gitlab.winehq.org/wine/wine/-/merge_requests/3097

[PATCH 1/1] sane: Fix use after free in create_item (scan-build).

[Alex Henrie]

From: Alex Henrie <alexhenrie24(a)gmail.com>

realloc may free lead_static.
---
 dlls/sane.ds/ui.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dlls/sane.ds/ui.c b/dlls/sane.ds/ui.c
index e66526a088e..6d67f35d389 100644
--- a/dlls/sane.ds/ui.c
+++ b/dlls/sane.ds/ui.c
@@ -257,7 +257,7 @@ static int create_item(HDC hdc, const struct option_descriptor *opt,
     tpl->style=styles;
     tpl->dwExtendedStyle = 0;
     if (lead_static)
-        tpl->x = lead_static->x + lead_static->cx + 1;
+        tpl->x = rc->x + rc->cx + 1;
     else if (opt->type == TYPE_GROUP)
         tpl->x = 2;
     else
-- 
GitLab

https://gitlab.winehq.org/wine/wine/-/merge_requests/3097

[Esme Povirk (＠madewokherd)]

lead_static is used again just a few lines later, I assume it's still invalid.

-- 
https://gitlab.winehq.org/wine/wine/-/merge_requests/3097#note_36137