From: Thomas Faber <thomas.faber@reactos.org>
Date: Fri, 31 Oct 2014 18:02:52 +0000 (+0000)
Subject: [SHELL32]
X-Git-Tag: backups/tcpip_revolution@71025~144
X-Git-Url: https://git.reactos.org/?p=reactos.git;a=commitdiff_plain;h=52f76a303d4ffe74c8ce3544a6325f95296dc912

[SHELL32]
- Fix a use after free in COpenWithMenu::Initialize. Powered by DPH.

svn path=/trunk/; revision=65156
---

diff --git a/reactos/dll/win32/shell32/openwithmenu.cpp b/reactos/dll/win32/shell32/openwithmenu.cpp
index a2033f819c6..93bdbf405fe 100644
--- a/reactos/dll/win32/shell32/openwithmenu.cpp
+++ b/reactos/dll/win32/shell32/openwithmenu.cpp
@@ -1334,6 +1334,14 @@ COpenWithMenu::Initialize(LPCITEMIDLIST pidlFolder,
     pidlFolder2 = (LPCITEMIDLIST) ((LPBYTE)pida + pida->aoffset[0]);
     pidlChild = (LPCITEMIDLIST) ((LPBYTE)pida + pida->aoffset[1]);
 
+    if (!_ILIsValue(pidlChild))
+    {
+        TRACE("pidl is not a file\n");
+        GlobalUnlock(medium.hGlobal);
+        GlobalFree(medium.hGlobal);
+        return E_FAIL;
+    }
+
     pidl = ILCombine(pidlFolder2, pidlChild);
 
     GlobalUnlock(medium.hGlobal);
@@ -1344,12 +1352,6 @@ COpenWithMenu::Initialize(LPCITEMIDLIST pidlFolder,
         ERR("no mem\n");
         return E_OUTOFMEMORY;
     }
-    if (!_ILIsValue(pidlChild))
-    {
-        TRACE("pidl is not a file\n");
-        SHFree((void*)pidl);
-        return E_FAIL;
-    }
 
     if (!SHGetPathFromIDListW(pidl, m_wszPath))
     {