Esme Povirk (@madewokherd) commented about dlls/uiautomationcore/uia_event.c:
- TRACE("%p, %p, %d\n", iface, elprov, event_id);
- if (!sink_event)
return E_OUTOFMEMORY;
- sink_event->args = create_uia_event_args(event_info);
- if (!sink_event->args)
- {
free(sink_event);
return E_OUTOFMEMORY;
- }
- IRawElementProviderSimple_AddRef(elprov);
- sink_event->elprov = elprov;
- list_add_tail(event->u.clientside.sink_events, &sink_event->event_sink_list_entry);
I think sink_events needs to be checked for NULL.