crypt32: Don't access a blob after freeing it.

dlls/crypt32/oid.c

@@ -85,7 +85,6 @@ static void free_function_sets(void)
 
         list_remove(&setCursor->next);
         CryptMemFree(setCursor->name);
-        CryptMemFree(setCursor);
         LIST_FOR_EACH_ENTRY_SAFE(functionCursor, funcNext,
          &setCursor->functions, struct OIDFunction, next)
         {
@@ -93,6 +92,7 @@ static void free_function_sets(void)
             CryptMemFree(functionCursor);
         }
         DeleteCriticalSection(&setCursor->cs);
+        CryptMemFree(setCursor);
     }
     DeleteCriticalSection(&funcSetCS);
 }

dlls/crypt32/store.c

@@ -534,8 +534,8 @@ static BOOL WINAPI CRYPT_MemDeleteCert(HCERTSTORE hCertStore,
              * protected.
              */
             list_remove(&cert->entry);
-            ret = CertFreeCertificateContext((PCCERT_CONTEXT)cert);
             cert->entry.prev = cert->entry.next = &store->certs;
+            ret = CertFreeCertificateContext((PCCERT_CONTEXT)cert);
             break;
         }
     }