Fabian Maurer : shell32: Prevent user after free in error case (Coverity).

[Alexandre Julliard]

Module: wine
Branch: stable
Commit: e2568dc4096742c6dc87ebae8d444af7f95eba05
URL:    https://gitlab.winehq.org/wine/wine/-/commit/e2568dc4096742c6dc87ebae8d444af...

Author: Fabian Maurer 
Date:   Tue Apr 26 21:03:19 2022 +0200

shell32: Prevent user after free in error case (Coverity).

Otherwise when hr is not SUCCEEDED we use array and free it again.

Signed-off-by: Fabian Maurer 
Signed-off-by: Nikolay Sivov 
Signed-off-by: Alexandre Julliard 
(cherry picked from commit d98646f915823d3bdf865743bb5b95c00e77cfa7)
Signed-off-by: Michael Stefaniuc

---

dlls/shell32/shellitem.c | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/dlls/shell32/shellitem.c b/dlls/shell32/shellitem.c
index 4693641d6ef..6a5418aebe5 100644
--- a/dlls/shell32/shellitem.c
+++ b/dlls/shell32/shellitem.c
@@ -1402,15 +1402,15 @@ HRESULT WINAPI SHCreateShellItemArrayFromIDLists(UINT cidl,
     if(SUCCEEDED(ret))
     {
         ret = create_shellitemarray(array, cidl, psia);
-        heap_free(array);
-        if(SUCCEEDED(ret))
-            return ret;
     }

-    for(i = 0; i < cidl; i++)
-        if(array[i]) IShellItem_Release(array[i]);
+    if(FAILED(ret))
+    {
+        for(i = 0; i < cidl; i++)
+            if(array[i]) IShellItem_Release(array[i]);
+        *psia = NULL;
+    }
     heap_free(array);
-    *psia = NULL;
     return ret;
 }