vbscript: Fix memory leak in owned safearray iterator.

dlls/vbscript/interp.c

@@ -1487,7 +1487,7 @@ static HRESULT interp_newenum(exec_ctx_t *ctx)
     case VT_VARIANT|VT_ARRAY|VT_BYREF: {
         IEnumVARIANT *iter;
 
-        hres = create_safearray_iter(V_ISBYREF(v.v) ? *V_ARRAYREF(v.v) : V_ARRAY(v.v), &iter);
+        hres = create_safearray_iter(V_ISBYREF(v.v) ? *V_ARRAYREF(v.v) : V_ARRAY(v.v), v.owned && !V_ISBYREF(v.v), &iter);
         if(FAILED(hres))
             return hres;
 

dlls/vbscript/utils.c

@@ -28,6 +28,7 @@ typedef struct {
     LONG ref;
 
     SAFEARRAY *sa;
+    BOOL owned;
     ULONG i, size;
 } safearray_iter;
 
@@ -75,8 +76,11 @@ static ULONG WINAPI safearray_iter_IEnumVARIANT_Release(IEnumVARIANT *iface)
     TRACE("(%p) ref=%ld\n", iface, ref);
 
     if(!ref) {
-        if(This->sa)
+        if(This->sa) {
             SafeArrayUnlock(This->sa);
+            if(This->owned)
+                SafeArrayDestroy(This->sa);
+	}
         free(This);
     }
 
@@ -160,7 +164,7 @@ static ULONG get_safearray_size(SAFEARRAY *sa)
     return ret;
 }
 
-HRESULT create_safearray_iter(SAFEARRAY *sa, IEnumVARIANT **ev)
+HRESULT create_safearray_iter(SAFEARRAY *sa, BOOL owned, IEnumVARIANT **ev)
 {
     safearray_iter *iter;
     HRESULT hres;
@@ -185,6 +189,7 @@ HRESULT create_safearray_iter(SAFEARRAY *sa, IEnumVARIANT **ev)
     iter->IEnumVARIANT_iface.lpVtbl = &safearray_iter_EnumVARIANTVtbl;
     iter->ref = 1;
     iter->sa = sa;
+    iter->owned = owned;
     iter->i = 0;
     iter->size = get_safearray_size(sa);
 

dlls/vbscript/vbscript.h

@@ -415,7 +415,7 @@ BSTR string_replace(BSTR,BSTR,BSTR,int,int,int) DECLSPEC_HIDDEN;
 
 void map_vbs_exception(EXCEPINFO *) DECLSPEC_HIDDEN;
 
-HRESULT create_safearray_iter(SAFEARRAY *sa, IEnumVARIANT **ev) DECLSPEC_HIDDEN;
+HRESULT create_safearray_iter(SAFEARRAY *sa, BOOL owned, IEnumVARIANT **ev) DECLSPEC_HIDDEN;
 
 #define FACILITY_VBS 0xa
 #define MAKE_VBSERROR(code) MAKE_HRESULT(SEVERITY_ERROR, FACILITY_VBS, code)