comctl32/imagelist: Fix reference leak in IImageList_Clone().

dlls/comctl32/imagelist.c

@@ -3392,16 +3392,21 @@ static HRESULT WINAPI ImageListImpl_Merge(IImageList *iface, int i1,
 static HRESULT WINAPI ImageListImpl_Clone(IImageList *iface, REFIID riid, void **ppv)
 {
     HIMAGELIST This = (HIMAGELIST) iface;
-    HIMAGELIST hNew;
+    HIMAGELIST clone;
     HRESULT ret = E_FAIL;
 
     TRACE("(%p)->(%s %p)\n", iface, debugstr_guid(riid), ppv);
 
-    hNew = ImageList_Duplicate(This);
+    clone = ImageList_Duplicate(This);
 
     /* Get the interface for the new image list */
-    if (hNew)
-        ret = HIMAGELIST_QueryInterface(hNew, riid, ppv);
+    if (clone)
+    {
+        IImageList *iclone = (IImageList*)clone;
+
+        ret = HIMAGELIST_QueryInterface(clone, riid, ppv);
+        IImageList_Release(iclone);
+    }
 
     return ret;
 }

dlls/comctl32/tests/imagelist.c

@@ -1332,7 +1332,7 @@ cleanup:
 
 static void test_iimagelist(void)
 {
-    IImageList *imgl;
+    IImageList *imgl, *imgl2;
     HIMAGELIST himl;
     HRESULT hr;
     ULONG ret;
@@ -1364,6 +1364,15 @@ static void test_iimagelist(void)
     ret = ImageList_Destroy((HIMAGELIST)imgl);
     ok(ret == FALSE, "Expected FALSE, got %d\n", ret);
 
+    /* ref counting, HIMAGELIST_QueryInterface adds a reference */
+    imgl = (IImageList*)createImageList(32, 32);
+    hr = pHIMAGELIST_QueryInterface((HIMAGELIST)imgl, &IID_IImageList, (void**)&imgl2);
+    ok(hr == S_OK, "got 0x%08x\n", hr);
+    ok(imgl2 == imgl, "got different pointer\n");
+    ret = IImageList_Release(imgl);
+    ok(ret == 1, "got %u\n", ret);
+    IImageList_Release(imgl);
+
     if (!pImageList_CoCreateInstance)
     {
         win_skip("Vista imagelist functions not available\n");
@@ -1783,6 +1792,7 @@ static void test_IImageList_Clone(void)
     IImageList *imgl, *imgl2;
     HIMAGELIST himl;
     HRESULT hr;
+    ULONG ref;
 
     himl = ImageList_Create(16, 16, ILC_COLOR16, 0, 3);
     imgl = (IImageList*)himl;
@@ -1795,7 +1805,8 @@ if (0)
 
     hr = IImageList_Clone(imgl, &IID_IImageList, (void**)&imgl2);
     ok(hr == S_OK, "got 0x%08x\n", hr);
-    IImageList_Release(imgl2);
+    ref = IImageList_Release(imgl2);
+    ok(ref == 0, "got %u\n", ref);
 
     IImageList_Release(imgl);
 }