On Dec 22, 2007 4:28 AM, Lionel_Debroux <[EMAIL PROTECTED]> wrote:
> Several functions in dlls/msi/action.c and dlls/msi/database.c use
> constructs of the form
> ptr = msi_realloc (ptr, newsize);
>
> In the (admittedly very unlikely) situation where msi_realloc fails,
> this leaks, or even faults:
> filename = msi_realloc(filename, len * sizeof(WCHAR) + sizeof(szlnk));
> memcpy(filename + len, szlnk, sizeof(szlnk));
>
> 2007-12-14 Lionel Debroux <[EMAIL PROTECTED]>
> * dlls/msi/action.c, dlls/msi/database.c:
> msi: correctly handle return value of msi_realloc.
>
- filename = msi_realloc(filename, len * sizeof(WCHAR) + sizeof(szlnk));
+ p = msi_realloc(filename, len * sizeof(WCHAR) + sizeof(szlnk));
+ if (!p)
+ {
+ msi_free(target_folder);
+ msi_free(filename);
+ ERR("Not enough memory to grow filename\n");
+ goto err;
+ }
+ filename = p;
Don't add ERRs for out of memory...and you need to return
ERROR_OUTOFMEMORY in these cases.
--
James Hawkins
