Re: [PATCH 4/7] shell32: Prevent user after free in error case (Coverity)

[Nikolay Sivov]

On 4/23/22 21:17, Fabian Maurer wrote:
> Otherwise when hr is not SUCCEEDED we use array and free it again.
> Signed-off-by: Fabian Maurer
>
> dlls/shell32/shellitem.c | 4 +++-
>   1 file changed, 3 insertions(+), 1 deletion(-)
>
> diff --git a/dlls/shell32/shellitem.c b/dlls/shell32/shellitem.c
> index 0a3a76cbd6a..8568ec34a83 100644
> --- a/dlls/shell32/shellitem.c
> +++ b/dlls/shell32/shellitem.c
> @@ -1402,9 +1402,11 @@ HRESULT WINAPI SHCreateShellItemArrayFromIDLists(UINT cidl,
>       if(SUCCEEDED(ret))
>       {
>           ret = create_shellitemarray(array, cidl, psia);
> -
>    heap_free(array);
>     if(SUCCEEDED(ret))
> -
>    {
> -
>        heap_free(array);
>         return ret;
> -
>    }
> }
>
> for(i = 0; i < cidl; i++)
>
> --
> 2.36.0

It would be shorter to release array elements when FAILED(), and have a 
single call to free pointers array.