Commit 01111b94 authored by Eric Pouech's avatar Eric Pouech Committed by Alexandre Julliard

msvcrt: Fix double-free and memory leak in type_info destructor.

Spotted by toying with the gcc's static analyzer. Signed-off-by: 's avatarEric Pouech <eric.pouech@gmail.com> Signed-off-by: 's avatarPiotr Caban <piotr@codeweavers.com> Signed-off-by: 's avatarAlexandre Julliard <julliard@winehq.org>
parent 6c64e6de
...@@ -457,7 +457,7 @@ void * __thiscall type_info_vector_dtor(type_info * _this, unsigned int flags) \ ...@@ -457,7 +457,7 @@ void * __thiscall type_info_vector_dtor(type_info * _this, unsigned int flags) \
/* we have an array, with the number of elements stored before the first object */ \ /* we have an array, with the number of elements stored before the first object */ \
INT_PTR i, *ptr = (INT_PTR *)_this - 1; \ INT_PTR i, *ptr = (INT_PTR *)_this - 1; \
\ \
for (i = *ptr - 1; i >= 0; i--) free(_this->name); \ for (i = *ptr - 1; i >= 0; i--) free(_this[i].name); \
free(ptr); \ free(ptr); \
} \ } \
else \ else \
......
...@@ -291,7 +291,7 @@ void * __thiscall type_info_vector_dtor(type_info * _this, unsigned int flags) \ ...@@ -291,7 +291,7 @@ void * __thiscall type_info_vector_dtor(type_info * _this, unsigned int flags) \
/* we have an array, with the number of elements stored before the first object */ \ /* we have an array, with the number of elements stored before the first object */ \
INT_PTR i, *ptr = (INT_PTR *)_this - 1; \ INT_PTR i, *ptr = (INT_PTR *)_this - 1; \
\ \
for (i = *ptr - 1; i >= 0; i--) free(_this->name); \ for (i = *ptr - 1; i >= 0; i--) free(_this[i].name); \
free(ptr); \ free(ptr); \
} \ } \
else \ else \
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment