[Bug 2848] New: possible memory leak in dlls/user/user16.c, function DragObject16

[Wine Bugs]

http://bugs.winehq.org/show_bug.cgi?id=2848

Summary: possible memory leak in dlls/user/user16.c, function
                    DragObject16
           Product: Wine
           Version: 20050310
          Platform: PC
        OS/Version: Linux
            Status: UNCONFIRMED
          Severity: minor
          Priority: P2
         Component: wine-gui
        AssignedTo: [e-mail]
        ReportedBy: [e-mail]

I am a research with the Stanford Checking group.

I am running some experiments on Wine using our static checking framework.  Here
is a possible bug we found with our tool:

In file dlls/user/user16.c:

LINE 1162:

--> hBummer is assigned a pointer return from LoadCursorA.  Because it
--> transitively loads an icon with the LR_SHARED flag, it returns an object
--> that has a reference count.

if (!(hBummer = LoadCursorA(0, MAKEINTRESOURCEA(OCR_NO))))
    {
        GlobalFree16(hDragInfo);
        return 0L;
    }

...

LINE: 1189
    /* update DRAGINFO struct */
    if( DRAG_QueryUpdate16(WIN_Handle32(hwndScope), spDragInfo) > 0 )
        hCurrentCursor = HCURSOR_32(hCursor);
    else
        {

--> Here hBummer is assigned to hCurrentCursor.  On the other branch, however,
--> it is not assigned and the value is never used assigned later.

hCurrentCursor = hBummer;
            lpDragInfo->hScope = 0;
    }
    if( hCurrentCursor )
        SetCursor(hCurrentCursor);

COMMENT: This appears to result in a memory leak, since a reference count
is incremented, even if the address in hBummer is never later stored.  It
could be possible this is allocated from an arena; I cannot tell.  I am
not very familiar with the Wine codebase.