[MMEBUDDY]

Fix use after free.

CID #716804

svn path=/trunk/; revision=62632

diff --git a/reactos/lib/drivers/sound/mmebuddy/deviceinstance.c b/reactos/lib/drivers/sound/mmebuddy/deviceinstance.c
index 33f23e3..2e34aa6 100644 (file)
--- a/reactos/lib/drivers/sound/mmebuddy/deviceinstance.c
+++ b/reactos/lib/drivers/sound/mmebuddy/deviceinstance.c
@@ -306,15 +306,16 @@ DestroyAllSoundDeviceInstances(
     IN  PSOUND_DEVICE SoundDevice)
 {
     MMRESULT Result;
-    PSOUND_DEVICE_INSTANCE SoundDeviceInstance;
+    PSOUND_DEVICE_INSTANCE SoundDeviceInstance, NextDeviceInstance;
 
     SoundDeviceInstance = SoundDevice->HeadInstance;
 
     while ( SoundDeviceInstance )
     {
+        NextDeviceInstance = SoundDeviceInstance->Next;
         Result = DestroySoundDeviceInstance(SoundDeviceInstance);
         SND_ASSERT( MMSUCCESS(Result) );
-        SoundDeviceInstance = SoundDeviceInstance->Next;
+        SoundDeviceInstance = NextDeviceInstance;
     }
 
     return MMSYSERR_NOERROR;