[tfaber] 69846: [WIN32K:NTUSER] - Don't leak the captured string in NtUserThunkedMenuItemInfo CORE-10493

Author: tfaber
Date: Sun Nov  8 07:57:14 2015
New Revision: 69846

URL: http://svn.reactos.org/svn/reactos?rev=69846&view=rev
Log:
[WIN32K:NTUSER]
- Don't leak the captured string in NtUserThunkedMenuItemInfo
CORE-10493

Modified:
    trunk/reactos/win32ss/user/ntuser/menu.c

Modified: trunk/reactos/win32ss/user/ntuser/menu.c
URL:
http://svn.reactos.org/svn/reactos/trunk/reactos/win32ss/user/ntuser/menu.c…
==============================================================================
--- trunk/reactos/win32ss/user/ntuser/menu.c	[iso-8859-1] (original)
+++ trunk/reactos/win32ss/user/ntuser/menu.c	[iso-8859-1] Sun Nov  8 07:57:14 2015
@@ -6216,12 +6216,12 @@
    /* lpszCaption may be NULL, check for it and call RtlInitUnicodeString()
       if bInsert == TRUE call UserInsertMenuItem() else UserSetMenuItemInfo()   */
 
+   RtlInitEmptyUnicodeString(&lstrCaption, NULL, 0);
+
    if (!(Menu = UserGetMenuObject(hMenu)))
    {
       RETURN(FALSE);
    }
-
-   RtlInitUnicodeString(&lstrCaption, 0);
 
    /* Check if we got a Caption */
    if (lpszCaption && lpszCaption->Buffer)
@@ -6243,6 +6243,11 @@
    RETURN( UserMenuItemInfo(Menu, uItem, fByPosition, (PROSMENUITEMINFO)lpmii, TRUE,
&lstrCaption));
 
 CLEANUP:
+   if (lstrCaption.Buffer)
+   {
+      ReleaseCapturedUnicodeString(&lstrCaption, UserMode);
+   }
+
    TRACE("Leave NtUserThunkedMenuItemInfo, ret=%i\n",_ret_);
    UserLeave();
    END_CLEANUP;