[fireball] 49229: [MSI] - Fix freed memory access and fix freeing of invalid pointer. (from http://www.winehq.org/pipermail/wine-patches/2010-October/094849.html ) See issue #3755 for more details.

Author: fireball
Date: Fri Oct 22 16:22:21 2010
New Revision: 49229

URL: http://svn.reactos.org/svn/reactos?rev=49229&view=rev
Log:
[MSI]
- Fix freed memory access and fix freeing of invalid pointer. (from
http://www.winehq.org/pipermail/wine-patches/2010-October/094849.html )
See issue #3755 for more details.

Modified:
    trunk/reactos/dll/win32/msi/action.c

Modified: trunk/reactos/dll/win32/msi/action.c
URL:
http://svn.reactos.org/svn/reactos/trunk/reactos/dll/win32/msi/action.c?rev…
==============================================================================
--- trunk/reactos/dll/win32/msi/action.c [iso-8859-1] (original)
+++ trunk/reactos/dll/win32/msi/action.c [iso-8859-1] Fri Oct 22 16:22:21 2010
@@ -1985,7 +1985,7 @@
 VS_FIXEDFILEINFO *msi_get_disk_file_version( LPCWSTR filename )
 {
     static const WCHAR name[] = {'\\',0};
-    VS_FIXEDFILEINFO *ret;
+    VS_FIXEDFILEINFO *ptr, *ret;
     LPVOID version;
     DWORD versize, handle;
     UINT sz;
@@ -2002,11 +2002,14 @@
 
     GetFileVersionInfoW( filename, 0, versize, version );
 
-    if (!VerQueryValueW( version, name, (LPVOID *)&ret, &sz ))
+    if (!VerQueryValueW( version, name, (LPVOID *)&ptr, &sz ))
     {
         msi_free( version );
         return NULL;
     }
+
+    ret = msi_alloc( sz );
+    memcpy( ret, ptr, sz );
 
     msi_free( version );
     return ret;