[WIN32K:NTUSER]
authorThomas Faber <thomas.faber@reactos.org>
Sun, 8 Nov 2015 07:57:14 +0000 (07:57 +0000)
committerThomas Faber <thomas.faber@reactos.org>
Sun, 8 Nov 2015 07:57:14 +0000 (07:57 +0000)
- Don't leak the captured string in NtUserThunkedMenuItemInfo
CORE-10493

svn path=/trunk/; revision=69846

reactos/win32ss/user/ntuser/menu.c

index 76ba92a..92631c4 100644 (file)
@@ -6216,13 +6216,13 @@ NtUserThunkedMenuItemInfo(
    /* lpszCaption may be NULL, check for it and call RtlInitUnicodeString()
       if bInsert == TRUE call UserInsertMenuItem() else UserSetMenuItemInfo()   */
 
+   RtlInitEmptyUnicodeString(&lstrCaption, NULL, 0);
+
    if (!(Menu = UserGetMenuObject(hMenu)))
    {
       RETURN(FALSE);
    }
 
-   RtlInitUnicodeString(&lstrCaption, 0);
-
    /* Check if we got a Caption */
    if (lpszCaption && lpszCaption->Buffer)
    {
@@ -6243,6 +6243,11 @@ NtUserThunkedMenuItemInfo(
    RETURN( UserMenuItemInfo(Menu, uItem, fByPosition, (PROSMENUITEMINFO)lpmii, TRUE, &lstrCaption));
 
 CLEANUP:
+   if (lstrCaption.Buffer)
+   {
+      ReleaseCapturedUnicodeString(&lstrCaption, UserMode);
+   }
+
    TRACE("Leave NtUserThunkedMenuItemInfo, ret=%i\n",_ret_);
    UserLeave();
    END_CLEANUP;