msvcrt: Fix double-free and memory leak in type_info destructor.

Spotted by toying with the gcc's static analyzer. Signed-off-by: Eric Pouech <eric.pouech@gmail.com> Signed-off-by: Piotr Caban <piotr@codeweavers.com> Signed-off-by: Alexandre Julliard <julliard@winehq.org>

msvcrt: Fix double-free and memory leak in type_info destructor.
01111b94 · Eric Pouech · Alexandre Julliard · 6c64e6de · 01111b94 · 01111b94
Commit 01111b94 authored Dec 16, 2021 by Eric Pouech Committed by Alexandre Julliard Dec 16, 2021
Hide whitespace changes
Inline Side-by-side

Showing with 2 additions and 2 deletions

cxx.h dlls/msvcp90/cxx.h +1 -1

cxx.h dlls/msvcrt/cxx.h +1 -1

No files found.
--- a/dlls/msvcp90/cxx.h
+++ b/dlls/msvcp90/cxx.h
@@ -457,7 +457,7 @@ void * __thiscall type_info_vector_dtor(type_info * _this, unsigned int flags) \
        /* we have an array, with the number of elements stored before the first object */ \
        INT_PTR i, *ptr = (INT_PTR *)_this - 1; \
 \
-        for (i = *ptr - 1; i >= 0; i--) free(_this->name); \
+        for (i = *ptr - 1; i >= 0; i--) free(_this[i].name); \
        free(ptr); \
    } \
    else \

--- a/dlls/msvcrt/cxx.h
+++ b/dlls/msvcrt/cxx.h
@@ -291,7 +291,7 @@ void * __thiscall type_info_vector_dtor(type_info * _this, unsigned int flags) \
        /* we have an array, with the number of elements stored before the first object */ \
        INT_PTR i, *ptr = (INT_PTR *)_this - 1; \
 \
-        for (i = *ptr - 1; i >= 0; i--) free(_this->name); \
+        for (i = *ptr - 1; i >= 0; i--) free(_this[i].name); \
        free(ptr); \
    } \
    else \