richedit: Prevented a dereference of a freed pointer.

On WM_DESTROY the editor was getting freed, then it was used to obtain a handle to the editor. This patch moves it just before the editor is freed within ME_DestroyEditor.

richedit: Prevented a dereference of a freed pointer.
c9977df8 · Dylan Smith · Alexandre Julliard · a8a97091 · c9977df8
Commit c9977df8 authored Dec 27, 2008 by Dylan Smith Committed by Alexandre Julliard Dec 27, 2008
Hide whitespace changes
Inline Side-by-side

Showing with 1 addition and 1 deletion

editor.c dlls/riched20/editor.c +1 -1

No files found.
--- a/dlls/riched20/editor.c
+++ b/dlls/riched20/editor.c
@@ -2685,6 +2685,7 @@ void ME_DestroyEditor(ME_TextEditor *editor)
    DeleteObject(editor->hbrBackground);
  if(editor->lpOleCallback)
    IUnknown_Release(editor->lpOleCallback);
+  SetWindowLongPtrW(editor->hWnd, 0, 0);
  OleUninitialize();

  FREE_OBJ(editor->pBuffer);
@@ -3821,7 +3822,6 @@ LRESULT ME_HandleMessage(ME_TextEditor *editor, UINT msg, WPARAM wParam,
  }
  case WM_DESTROY:
    ME_DestroyEditor(editor);
-    SetWindowLongPtrW(editor->hWnd, 0, 0);
    return 0;
  case WM_SETCURSOR:
  {