[PATCH v3 2/2] d2d1: Fix double free bug when d2d_geometry_sink_Close fails

[Brendan McGrath]

From: Brendan McGrath

geometry->fill.bezier_vertices was being freed on the failed path in
d2d_geometry_sink_Close and then again when the path geometry was
released (in d2d_geometry_cleanup).

By setting it to NULL after freeing it initially, all other calls
to free it are a no-op.
---
 dlls/d2d1/geometry.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/dlls/d2d1/geometry.c b/dlls/d2d1/geometry.c
index ffc75d1080a..4cb9c5aff1c 100644
--- a/dlls/d2d1/geometry.c
+++ b/dlls/d2d1/geometry.c
@@ -3239,6 +3239,7 @@ done:
     if (FAILED(hr))
     {
         free(geometry->fill.bezier_vertices);
+        geometry->fill.bezier_vertices = NULL;
         geometry->fill.bezier_vertex_count = 0;
         d2d_path_geometry_free_figures(geometry);
         geometry->u.path.state = D2D_GEOMETRY_STATE_ERROR;