[PATCH 0/2] MR7915: shell32: Fix use-after-free at FolderItemVerbs creation (ASan).

[Nikolay Sivov (＠nsivov)]

Signed-off-by: Nikolay Sivov

[PATCH 1/2] shell32: Simplify error handling when FolderItemVerbs object is created.

[Nikolay Sivov]

From: Nikolay Sivov

Signed-off-by: Nikolay Sivov 
---
 dlls/shell32/shelldispatch.c | 34 ++++++++++++++++------------------
 1 file changed, 16 insertions(+), 18 deletions(-)

diff --git a/dlls/shell32/shelldispatch.c b/dlls/shell32/shelldispatch.c
index dd58c755c61..0b2ad0ab0e2 100644
--- a/dlls/shell32/shelldispatch.c
+++ b/dlls/shell32/shelldispatch.c
@@ -412,7 +412,8 @@ static ULONG WINAPI FolderItemVerbsImpl_Release(FolderItemVerbs *iface)

if (!ref)
     {
-        IContextMenu_Release(This->contextmenu);
+        if (This->contextmenu)
+            IContextMenu_Release(This->contextmenu);
         DestroyMenu(This->hMenu);
         free(This);
     }
@@ -581,14 +582,14 @@ static FolderItemVerbsVtbl folderitemverbsvtbl = {
 static HRESULT FolderItemVerbs_Constructor(BSTR path, FolderItemVerbs **verbs)
 {
     FolderItemVerbsImpl *This;
-    IShellFolder *folder;
+    LPITEMIDLIST pidl = NULL;
+    IShellFolder *folder = NULL;
     LPCITEMIDLIST child;
-    LPITEMIDLIST pidl;
     HRESULT hr;

*verbs = NULL;

-    This = malloc(sizeof(*This));
+    This = calloc(1, sizeof(*This));
     if (!This)
         return E_OUTOFMEMORY;

@@ -597,21 +598,22 @@ static HRESULT FolderItemVerbs_Constructor(BSTR path, FolderItemVerbs **verbs)

/* build context menu for this path */
     hr = SHParseDisplayName(path, NULL, &pidl, 0, NULL);
-    if (FAILED(hr))
-        goto failed;

-    hr = SHBindToParent(pidl, &IID_IShellFolder, (void**)&folder, &child);
+    if (SUCCEEDED(hr))
+        hr = SHBindToParent(pidl, &IID_IShellFolder, (void**)&folder, &child);
+
     CoTaskMemFree(pidl);
-    if (FAILED(hr))
-        goto failed;

-    hr = IShellFolder_GetUIObjectOf(folder, NULL, 1, &child, &IID_IContextMenu, NULL, (void**)&This->contextmenu);
-    IShellFolder_Release(folder);
-    if (FAILED(hr))
-        goto failed;
+    if (SUCCEEDED(hr))
+        hr = IShellFolder_GetUIObjectOf(folder, NULL, 1, &child, &IID_IContextMenu, NULL, (void**)&This->contextmenu);
+
+    if (folder)
+        IShellFolder_Release(folder);

This->hMenu = CreatePopupMenu();
-    hr = IContextMenu_QueryContextMenu(This->contextmenu, This->hMenu, 0, FCIDM_SHVIEWFIRST, FCIDM_SHVIEWLAST, CMF_NORMAL);
+    if (SUCCEEDED(hr))
+        hr = IContextMenu_QueryContextMenu(This->contextmenu, This->hMenu, 0, FCIDM_SHVIEWFIRST, FCIDM_SHVIEWLAST, CMF_NORMAL);
+
     if (FAILED(hr))
     {
         FolderItemVerbs_Release(&This->FolderItemVerbs_iface);
@@ -621,10 +623,6 @@ static HRESULT FolderItemVerbs_Constructor(BSTR path, FolderItemVerbs **verbs)
     This->count = GetMenuItemCount(This->hMenu);
     *verbs = &This->FolderItemVerbs_iface;
     return S_OK;
-
-failed:
-    free(This);
-    return hr;
 }

static HRESULT WINAPI ShellLinkObject_QueryInterface(IShellLinkDual2 *iface, REFIID riid,

[PATCH 2/2] shell32: Fix use-after-free at FolderItemVerbs creation (ASan).

[Nikolay Sivov]

From: Nikolay Sivov

The 'child' pidl is a pointer whithin its parent pidl, it's only valid
as long as the parent is still around.

Signed-off-by: Nikolay Sivov 
---
 dlls/shell32/shelldispatch.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/dlls/shell32/shelldispatch.c b/dlls/shell32/shelldispatch.c
index 0b2ad0ab0e2..06b853ca3dc 100644
--- a/dlls/shell32/shelldispatch.c
+++ b/dlls/shell32/shelldispatch.c
@@ -602,13 +602,12 @@ static HRESULT FolderItemVerbs_Constructor(BSTR path, FolderItemVerbs **verbs)
     if (SUCCEEDED(hr))
         hr = SHBindToParent(pidl, &IID_IShellFolder, (void**)&folder, &child);

-    CoTaskMemFree(pidl);
-
     if (SUCCEEDED(hr))
         hr = IShellFolder_GetUIObjectOf(folder, NULL, 1, &child, &IID_IContextMenu, NULL, (void**)&This->contextmenu);

if (folder)
         IShellFolder_Release(folder);
+    CoTaskMemFree(pidl);

This->hMenu = CreatePopupMenu();
     if (SUCCEEDED(hr))