Commit 55ad3fdd authored by Hans Leidekker's avatar Hans Leidekker Committed by Alexandre Julliard

msi: Fix another double free.

parser_alloc() allocates memory and puts it on a list attached the to query object. EXPR_sval() frees memory allocated via parser_alloc() on error but does not remove the pointer from the list, which means that when the query destructor is called it will be freed again.
parent 91ac47b8
......@@ -876,10 +876,7 @@ static struct expr * EXPR_sval( void *info, const struct sql_str *str )
{
e->type = EXPR_SVAL;
if( SQL_getstring( info, str, (LPWSTR *)&e->u.sval ) != ERROR_SUCCESS )
{
msi_free( e );
return NULL;
}
return NULL; /* e will be freed by query destructor */
}
return e;
}
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment