d2d1: Fix double free bug when d2d_geometry_sink_Close fails.

geometry->fill.bezier_vertices was being freed on the failed path in d2d_geometry_sink_Close and then again when the path geometry was released (in d2d_geometry_cleanup). By setting it to NULL after freeing it initially, all other calls to free it are a no-op.

d2d1: Fix double free bug when d2d_geometry_sink_Close fails.
1e79217f · Brendan McGrath · Alexandre Julliard · 6d8489a0 · 1e79217f
Commit 1e79217f authored Jan 11, 2024 by Brendan McGrath Committed by Alexandre Julliard Jan 26, 2024
Show whitespace changes
Inline Side-by-side

Showing with 1 addition and 0 deletions

geometry.c dlls/d2d1/geometry.c +1 -0

No files found.
--- a/dlls/d2d1/geometry.c
+++ b/dlls/d2d1/geometry.c
@@ -3247,6 +3247,7 @@ done:
    if (FAILED(hr))
    {
        free(geometry->fill.bezier_vertices);
+        geometry->fill.bezier_vertices = NULL;
        geometry->fill.bezier_vertex_count = 0;
        d2d_path_geometry_free_figures(geometry);
        geometry->u.path.state = D2D_GEOMETRY_STATE_ERROR;