[PATCH 0/1] MR8318: shell32: Fix use-after-free in ShellView_WndProc.

[Yuxuan Shui (＠yshui)]

RevokeDragDrop release the drop target, if that happens to be the shell view
itself, doing so will cause pThis to be freed.

* * *

I am not 100% sure if the call order does indeed not matter...

[PATCH 1/1] shell32: Fix use-after-free in ShellView_WndProc.

[Yuxuan Shui]

From: Yuxuan Shui

RevokeDragDrop release the drop target, if that happens to be the shell view
itself, doing so will cause pThis to be freed.
---
 dlls/shell32/shlview.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dlls/shell32/shlview.c b/dlls/shell32/shlview.c
index a39d51dae2a..b1524b1f29f 100644
--- a/dlls/shell32/shlview.c
+++ b/dlls/shell32/shlview.c
@@ -1696,8 +1696,8 @@ static LRESULT CALLBACK ShellView_WndProc(HWND hWnd, UINT uMessage, WPARAM wPara
           case WM_GETFONT:      return SendMessageW(pThis->hWndList, WM_GETFONT, wParam, lParam);

case WM_DESTROY:	
-	  			RevokeDragDrop(pThis->hWnd);
    			SHChangeNotifyDeregister(pThis->hNotify);
+				RevokeDragDrop(pThis->hWnd);
                            break;

case WM_ERASEBKGND: