Author: pschweitzer Date: Sat Apr 5 21:08:10 2014 New Revision: 62632
URL: http://svn.reactos.org/svn/reactos?rev=62632&view=rev Log: [MMEBUDDY] Fix use after free.
CID #716804
Modified: trunk/reactos/lib/drivers/sound/mmebuddy/deviceinstance.c
Modified: trunk/reactos/lib/drivers/sound/mmebuddy/deviceinstance.c URL: http://svn.reactos.org/svn/reactos/trunk/reactos/lib/drivers/sound/mmebuddy/... ============================================================================== --- trunk/reactos/lib/drivers/sound/mmebuddy/deviceinstance.c [iso-8859-1] (original) +++ trunk/reactos/lib/drivers/sound/mmebuddy/deviceinstance.c [iso-8859-1] Sat Apr 5 21:08:10 2014 @@ -306,15 +306,16 @@ IN PSOUND_DEVICE SoundDevice) { MMRESULT Result; - PSOUND_DEVICE_INSTANCE SoundDeviceInstance; + PSOUND_DEVICE_INSTANCE SoundDeviceInstance, NextDeviceInstance;
SoundDeviceInstance = SoundDevice->HeadInstance;
while ( SoundDeviceInstance ) { + NextDeviceInstance = SoundDeviceInstance->Next; Result = DestroySoundDeviceInstance(SoundDeviceInstance); SND_ASSERT( MMSUCCESS(Result) ); - SoundDeviceInstance = SoundDeviceInstance->Next; + SoundDeviceInstance = NextDeviceInstance; }
return MMSYSERR_NOERROR;