[PATCH 4/5] wintypes: Create a copy for string arrays for property_value_statics_CreateStringArray().

[Zhiyi Zhang]

From: Zhiyi Zhang

Similar to 4b1e53ce to avoid use-after-free.
---
 dlls/wintypes/main.c | 42 +++++++++++++++++++++++++++++++++++++++++-
 1 file changed, 41 insertions(+), 1 deletion(-)

diff --git a/dlls/wintypes/main.c b/dlls/wintypes/main.c
index 2cd7879e12a..08021564315 100644
--- a/dlls/wintypes/main.c
+++ b/dlls/wintypes/main.c
@@ -600,7 +600,17 @@ static ULONG STDMETHODCALLTYPE property_value_Release(IPropertyValue *iface)
         if (impl->value)
         {
             if (impl->type == PropertyType_String)
+            {
                 WindowsDeleteString(*(HSTRING *)impl->value);
+            }
+            else if (impl->type == PropertyType_StringArray)
+            {
+                HSTRING *string_array = impl->value;
+                unsigned int i;
+
+                for (i = 0; i < impl->value_size; i++)
+                    WindowsDeleteString(string_array[i]);
+            }
             free(impl->value);
         }
         free(impl);
@@ -1614,8 +1624,38 @@ static HRESULT STDMETHODCALLTYPE property_value_statics_CreateBooleanArray(IProp
 static HRESULT STDMETHODCALLTYPE property_value_statics_CreateStringArray(IPropertyValueStatics *iface,
         UINT32 value_size, HSTRING *value, IInspectable **property_value)
 {
+    struct property_value *impl;
+    HSTRING *new_value;
+    unsigned int i;
+
     TRACE("iface %p, value_size %u, value %p, property_value %p.\n", iface, value_size, value, property_value);
-    return create_primitive_property_value_array(PropertyType_StringArray);
+
+    if (!value || !property_value)
+        return E_POINTER;
+
+    impl = calloc(1, sizeof(*impl));
+    if (!impl)
+        return E_OUTOFMEMORY;
+
+    new_value = calloc(value_size, sizeof(HSTRING));
+    if (!new_value)
+    {
+        free(impl);
+        return E_OUTOFMEMORY;
+    }
+
+    for (i = 0; i < value_size; i++)
+        WindowsDuplicateString(value[i], &new_value[i]);
+
+    impl->IPropertyValue_iface.lpVtbl = &property_value_vtbl;
+    impl->type = PropertyType_StringArray;
+    impl->ref = 1;
+    impl->value = new_value;
+    impl->value_size = value_size;
+
+    *property_value = (IInspectable *)&impl->IPropertyValue_iface;
+    return S_OK;
+
 }

static HRESULT STDMETHODCALLTYPE property_value_statics_CreateInspectableArray(IPropertyValueStatics *iface,