[PATCH 1/1] vbscript: Fix memory leak in owned safearray iterator

[Jason Millard]

From: Jason Millard

---
 dlls/vbscript/interp.c   | 2 +-
 dlls/vbscript/utils.c    | 9 +++++++--
 dlls/vbscript/vbscript.h | 2 +-
 3 files changed, 9 insertions(+), 4 deletions(-)

diff --git a/dlls/vbscript/interp.c b/dlls/vbscript/interp.c
index b3be3bea6cf..eaed826a8a0 100644
--- a/dlls/vbscript/interp.c
+++ b/dlls/vbscript/interp.c
@@ -1480,7 +1480,7 @@ static HRESULT interp_newenum(exec_ctx_t *ctx)
     case VT_VARIANT|VT_ARRAY|VT_BYREF: {
         IEnumVARIANT *iter;

-        hres = create_safearray_iter(V_ISBYREF(v.v) ? *V_ARRAYREF(v.v) : V_ARRAY(v.v), &iter);
+        hres = create_safearray_iter(V_ISBYREF(v.v) ? *V_ARRAYREF(v.v) : V_ARRAY(v.v), v.owned, &iter);
         if(FAILED(hres))
             return hres;

diff --git a/dlls/vbscript/utils.c b/dlls/vbscript/utils.c
index 03b1abde481..4bfc2c65a0a 100644
--- a/dlls/vbscript/utils.c
+++ b/dlls/vbscript/utils.c
@@ -28,6 +28,7 @@ typedef struct {
     LONG ref;

SAFEARRAY *sa;
+    BOOL owned;
     ULONG i, size;
 } safearray_iter;

@@ -75,8 +76,11 @@ static ULONG WINAPI safearray_iter_IEnumVARIANT_Release(IEnumVARIANT *iface)
     TRACE("(%p) ref=%ld\n", iface, ref);

if(!ref) {
-        if(This->sa)
+        if(This->sa) {
             SafeArrayUnlock(This->sa);
+            if(This->owned)
+                SafeArrayDestroy(This->sa);
+	}
         free(This);
     }

@@ -160,7 +164,7 @@ static ULONG get_safearray_size(SAFEARRAY *sa)
     return ret;
 }

-HRESULT create_safearray_iter(SAFEARRAY *sa, IEnumVARIANT **ev)
+HRESULT create_safearray_iter(SAFEARRAY *sa, BOOL owned, IEnumVARIANT **ev)
 {
     safearray_iter *iter;
     HRESULT hres;
@@ -185,6 +189,7 @@ HRESULT create_safearray_iter(SAFEARRAY *sa, IEnumVARIANT **ev)
     iter->IEnumVARIANT_iface.lpVtbl = &safearray_iter_EnumVARIANTVtbl;
     iter->ref = 1;
     iter->sa = sa;
+    iter->owned = owned;
     iter->i = 0;
     iter->size = get_safearray_size(sa);

diff --git a/dlls/vbscript/vbscript.h b/dlls/vbscript/vbscript.h
index 5b0a2222767..13bcf704bf0 100644
--- a/dlls/vbscript/vbscript.h
+++ b/dlls/vbscript/vbscript.h
@@ -415,7 +415,7 @@ BSTR string_replace(BSTR,BSTR,BSTR,int,int,int) DECLSPEC_HIDDEN;

void map_vbs_exception(EXCEPINFO *) DECLSPEC_HIDDEN;

-HRESULT create_safearray_iter(SAFEARRAY *sa, IEnumVARIANT **ev) DECLSPEC_HIDDEN;
+HRESULT create_safearray_iter(SAFEARRAY *sa, BOOL owned, IEnumVARIANT **ev) DECLSPEC_HIDDEN;

#define FACILITY_VBS 0xa
 #define MAKE_VBSERROR(code) MAKE_HRESULT(SEVERITY_ERROR, FACILITY_VBS, code)