msi: Fix use after free error in TransformView_set_row.

Signed-off-by: Piotr Caban <piotr@codeweavers.com> Signed-off-by: Hans Leidekker <hans@codeweavers.com> Signed-off-by: Alexandre Julliard <julliard@winehq.org>

msi: Fix use after free error in TransformView_set_row.
6a0a0d2a · Piotr Caban · Alexandre Julliard · 25d6abb9 · 6a0a0d2a
Commit 6a0a0d2a authored Jul 01, 2020 by Piotr Caban Committed by Alexandre Julliard Jul 02, 2020
Hide whitespace changes
Inline Side-by-side

Showing with 5 additions and 1 deletion

table.c dlls/msi/table.c +5 -1

No files found.
--- a/dlls/msi/table.c
+++ b/dlls/msi/table.c
@@ -2341,7 +2341,7 @@ static UINT TransformView_set_row( MSIVIEW *view, UINT row, MSIRECORD *rec, UINT
        L"INSERT INTO `_TransformView` (`Table`, `Column`, `Row`, `Data`, `Current`) VALUES ('";

    MSITABLEVIEW *tv = (MSITABLEVIEW*)view;
-    WCHAR buf[256], *query = buf;
+    WCHAR buf[256], *query;
    MSIRECORD *old_rec;
    MSIQUERY *q;
    WCHAR *key;
@@ -2409,6 +2409,10 @@ static UINT TransformView_set_row( MSIVIEW *view, UINT row, MSIRECORD *rec, UINT
                return ERROR_OUTOFMEMORY;
            }
        }
+        else
+        {
+            query = buf;
+        }

        memcpy( query, query_pfx, p * sizeof(WCHAR) );
        len = wcslen( tv->name );