Author: tfaber
Date: Fri Oct 31 18:02:52 2014
New Revision: 65156
URL: http://svn.reactos.org/svn/reactos?rev=65156&view=rev
Log:
[SHELL32]
- Fix a use after free in COpenWithMenu::Initialize. Powered by DPH.
Modified:
trunk/reactos/dll/win32/shell32/openwithmenu.cpp
Modified: trunk/reactos/dll/win32/shell32/openwithmenu.cpp
URL:
http://svn.reactos.org/svn/reactos/trunk/reactos/dll/win32/shell32/openwithmenu.cpp?rev=65156&r1=65155&r2=65156&view=diff
==============================================================================
--- trunk/reactos/dll/win32/shell32/openwithmenu.cpp [iso-8859-1] (original)
+++ trunk/reactos/dll/win32/shell32/openwithmenu.cpp [iso-8859-1] Fri Oct 31
18:02:52 2014
@@ -1334,6 +1334,14 @@
pidlFolder2 = (LPCITEMIDLIST) ((LPBYTE)pida + pida->aoffset[0]);
pidlChild = (LPCITEMIDLIST) ((LPBYTE)pida + pida->aoffset[1]);
+ if (!_ILIsValue(pidlChild))
+ {
+ TRACE("pidl is not a file\n");
+ GlobalUnlock(medium.hGlobal);
+ GlobalFree(medium.hGlobal);
+ return E_FAIL;
+ }
+
pidl = ILCombine(pidlFolder2, pidlChild);
GlobalUnlock(medium.hGlobal);
@@ -1343,12 +1351,6 @@
{
ERR("no mem\n");
return E_OUTOFMEMORY;
- }
- if (!_ILIsValue(pidlChild))
- {
- TRACE("pidl is not a file\n");
- SHFree((void*)pidl);
- return E_FAIL;
}
if (!SHGetPathFromIDListW(pidl, m_wszPath))
