[PATCH 0/1] MR3037: msi: Fix double free on error paths in TransformView_Create (scan-build).

[Alex Henrie (＠alexhenrie)]

If TransformView_Create returns an error, it should not return a pointer
that table_load_transform will try to free.

-- 
https://gitlab.winehq.org/wine/wine/-/merge_requests/3037

[PATCH 1/1] msi: Fix double free on error paths in TransformView_Create (scan-build).

[Alex Henrie]

From: Alex Henrie <alexhenrie24(a)gmail.com>

If TransformView_Create returns an error, it should not return a pointer
that table_load_transform will try to free.
---
 dlls/msi/table.c | 9 +++------
 1 file changed, 3 insertions(+), 6 deletions(-)

diff --git a/dlls/msi/table.c b/dlls/msi/table.c
index 77fa20502c5..ea4ef3b0d0e 100644
--- a/dlls/msi/table.c
+++ b/dlls/msi/table.c
@@ -2779,7 +2779,7 @@ static UINT TransformView_Create( MSIDATABASE *db, string_table *st, LPCWSTR nam
 
     name_len = wcslen( name );
 
-    r = TABLE_CreateView( db, name, view );
+    r = TABLE_CreateView( db, name, (MSIVIEW **)&tv );
     if (r == ERROR_INVALID_PARAMETER)
     {
         /* table does not exist */
@@ -2790,16 +2790,11 @@ static UINT TransformView_Create( MSIDATABASE *db, string_table *st, LPCWSTR nam
 
         tv->db = db;
         memcpy( tv->name, name, name_len * sizeof(WCHAR) );
-        *view = (MSIVIEW*)tv;
     }
     else if (r != ERROR_SUCCESS)
     {
         return r;
     }
-    else
-    {
-        tv = (struct table_view *)*view;
-    }
 
     tv->view.ops = &transform_view_ops;
 
@@ -2847,6 +2842,7 @@ static UINT TransformView_Create( MSIDATABASE *db, string_table *st, LPCWSTR nam
     {
         MSI_ViewClose( q );
         msiobj_release( &q->hdr );
+        *view = (MSIVIEW *)tv;
         return ERROR_SUCCESS;
     }
 
@@ -2883,6 +2879,7 @@ static UINT TransformView_Create( MSIDATABASE *db, string_table *st, LPCWSTR nam
     memcpy( colinfo, tv->columns, tv->num_cols * sizeof(*colinfo) );
     tv->columns = colinfo;
     tv->num_cols += add_col;
+    *view = (MSIVIEW *)tv;
     return ERROR_SUCCESS;
 }
 
-- 
GitLab

https://gitlab.winehq.org/wine/wine/-/merge_requests/3037

[PATCH 0/1] MR3037: msi: Fix double free on error paths in TransformView_Create (scan-build). - approved

[Hans Leidekker (＠hans)]

This merge request was approved by Hans Leidekker.
-- 
https://gitlab.winehq.org/wine/wine/-/merge_requests/3037