[Bug 20896] Use-after-free in DdeClientTransaction in user32 dde tests

http://bugs.winehq.org/show_bug.cgi?id=20896

--- Comment #4 from Dan Kegel  2011-10-19 20:38:15 CDT ---
Here's an slightly less inlined stack:

Invalid read of size 2
    at GlobalFree (heap.c:758)
    by WDML_FreeTransaction (dde_misc.c:2444)
    by DdeClientTransaction (dde_client.c:1228)
    by test_ddeml_client (dde.c:406, 416)
    by func_dde (dde.c:2702)
  Address 0x7f032ab8 is 0 bytes inside a block of size 8 free'd
    at notify_free (heap.c:262)
    by RtlFreeHeap (heap.c:1748)
    by HeapFree (heap.c:272)
    by GlobalFree (heap.c:770)
    by WDML_HandlePokeReply (dde_client.c:781)
    by WDML_HandleReply (dde_client.c:946)
    by WDML_SyncWaitTransactionReply (dde_client.c:1053)
    by WDML_ClientHandle (dde_client.c:1126)
    by DdeClientTransaction (dde_client.c:1224)
    by test_ddeml_client (dde.c:406)
    by func_dde (dde.c:2702)