msi: Fix another double free.

parser_alloc() allocates memory and puts it on a list attached the to query object. EXPR_sval() frees memory allocated via parser_alloc() on error but does not remove the pointer from the list, which means that when the query destructor is called it will be freed again.

msi: Fix another double free.
55ad3fdd · Hans Leidekker · Alexandre Julliard · 91ac47b8 · 55ad3fdd
Commit 55ad3fdd authored Apr 20, 2009 by Hans Leidekker Committed by Alexandre Julliard Apr 20, 2009
Show whitespace changes
Inline Side-by-side

Showing with 1 addition and 4 deletions

sql.y dlls/msi/sql.y +1 -4

No files found.
--- a/dlls/msi/sql.y
+++ b/dlls/msi/sql.y
@@ -876,10 +876,7 @@ static struct expr * EXPR_sval( void *info, const struct sql_str *str )
    {
        e->type = EXPR_SVAL;
        if( SQL_getstring( info, str, (LPWSTR *)&e->u.sval ) != ERROR_SUCCESS )
-        {
+            return NULL; /* e will be freed by query destructor */
-            msi_free( e );
-            return NULL;
-        }
    }
    return e;
 }