[SHELL32]
authorThomas Faber <thomas.faber@reactos.org>
Fri, 31 Oct 2014 18:02:52 +0000 (18:02 +0000)
committerThomas Faber <thomas.faber@reactos.org>
Fri, 31 Oct 2014 18:02:52 +0000 (18:02 +0000)
- Fix a use after free in COpenWithMenu::Initialize. Powered by DPH.

svn path=/trunk/; revision=65156

reactos/dll/win32/shell32/openwithmenu.cpp

index a2033f8..93bdbf4 100644 (file)
@@ -1334,6 +1334,14 @@ COpenWithMenu::Initialize(LPCITEMIDLIST pidlFolder,
     pidlFolder2 = (LPCITEMIDLIST) ((LPBYTE)pida + pida->aoffset[0]);
     pidlChild = (LPCITEMIDLIST) ((LPBYTE)pida + pida->aoffset[1]);
 
+    if (!_ILIsValue(pidlChild))
+    {
+        TRACE("pidl is not a file\n");
+        GlobalUnlock(medium.hGlobal);
+        GlobalFree(medium.hGlobal);
+        return E_FAIL;
+    }
+
     pidl = ILCombine(pidlFolder2, pidlChild);
 
     GlobalUnlock(medium.hGlobal);
@@ -1344,12 +1352,6 @@ COpenWithMenu::Initialize(LPCITEMIDLIST pidlFolder,
         ERR("no mem\n");
         return E_OUTOFMEMORY;
     }
-    if (!_ILIsValue(pidlChild))
-    {
-        TRACE("pidl is not a file\n");
-        SHFree((void*)pidl);
-        return E_FAIL;
-    }
 
     if (!SHGetPathFromIDListW(pidl, m_wszPath))
     {