https://git.reactos.org/?p=reactos.git;a=commitdiff;h=c6c4bdb242b712cf280201ed167b853673f9b2cc
commit c6c4bdb242b712cf280201ed167b853673f9b2cc Author: winesync <[email protected]> AuthorDate: Sun Mar 13 19:08:44 2022 +0100 Commit: Mark Jansen <[email protected]> CommitDate: Sun Mar 20 19:28:32 2022 +0100 [WINESYNC] msi: Fix use after free error in TransformView_set_row. Signed-off-by: Piotr Caban <[email protected]> Signed-off-by: Hans Leidekker <[email protected]> Signed-off-by: Alexandre Julliard <[email protected]> wine commit id 6a0a0d2a0b15bffa9d4a5b41e75be6765e731d69 by Piotr Caban <[email protected]> --- dll/win32/msi/table.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/dll/win32/msi/table.c b/dll/win32/msi/table.c index d4912ab3ae3..3febcb3aa94 100644 --- a/dll/win32/msi/table.c +++ b/dll/win32/msi/table.c @@ -2341,7 +2341,7 @@ static UINT TransformView_set_row( MSIVIEW *view, UINT row, MSIRECORD *rec, UINT L"INSERT INTO `_TransformView` (`Table`, `Column`, `Row`, `Data`, `Current`) VALUES ('"; MSITABLEVIEW *tv = (MSITABLEVIEW*)view; - WCHAR buf[256], *query = buf; + WCHAR buf[256], *query; MSIRECORD *old_rec; MSIQUERY *q; WCHAR *key; @@ -2409,6 +2409,10 @@ static UINT TransformView_set_row( MSIVIEW *view, UINT row, MSIRECORD *rec, UINT return ERROR_OUTOFMEMORY; } } + else + { + query = buf; + } memcpy( query, query_pfx, p * sizeof(WCHAR) ); len = wcslen( tv->name );
