riched20: Fix a use after free.

In ME_DestroyEditor(), the item list is being freed when calling get_total_width() in destroy_para(). Wine-Bug: https://bugs.winehq.org/show_bug.cgi?id=46328Signed-off-by: Zhiyi Zhang <zzhang@codeweavers.com> Signed-off-by: Huw Davies <huw@codeweavers.com> Signed-off-by: Alexandre Julliard <julliard@winehq.org>

riched20: Fix a use after free.
62d80cff · Zhiyi Zhang · Alexandre Julliard · d3ca7db4 · 62d80cff
Commit 62d80cff authored Jan 02, 2019 by Zhiyi Zhang Committed by Alexandre Julliard Jan 02, 2019
Hide whitespace changes
Inline Side-by-side

Showing with 2 additions and 2 deletions

editor.c dlls/riched20/editor.c +2 -2

No files found.
--- a/dlls/riched20/editor.c
+++ b/dlls/riched20/editor.c
@@ -3183,13 +3183,13 @@ ME_TextEditor *ME_MakeEditor(ITextHost *texthost, BOOL bEmulateVersion10)

 void ME_DestroyEditor(ME_TextEditor *editor)
 {
-  ME_DisplayItem *pFirst = editor->pBuffer->pFirst;
-  ME_DisplayItem *p = pFirst, *pNext = NULL;
+  ME_DisplayItem *p = editor->pBuffer->pFirst, *pNext = NULL;
  ME_Style *s, *cursor2;
  int i;

  ME_ClearTempStyle(editor);
  ME_EmptyUndoStack(editor);
+  editor->pBuffer->pFirst = NULL;
  while(p) {
    pNext = p->next;
    if (p->type == diParagraph)