From 4a177f64242f58ad62a25f23059ed3665e37641b Mon Sep 17 00:00:00 2001
From: Pierre Schweitzer <pierre@reactos.org>
Date: Wed, 7 Dec 2011 22:16:00 +0000
Subject: [PATCH] [MSACM32] Check allocation success. Prevent buffer double
 free. Already sent & committed upstream:
 http://source.winehq.org/git/wine.git/commit/1ac7096728dbb46a56f84fa0d25fdc3cc5282519

svn path=/trunk/; revision=54610
---
 reactos/dll/win32/msacm32/internal.c | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/reactos/dll/win32/msacm32/internal.c b/reactos/dll/win32/msacm32/internal.c
index feb6e9cb6cc..b9b80c1cf60 100644
--- a/reactos/dll/win32/msacm32/internal.c
+++ b/reactos/dll/win32/msacm32/internal.c
@@ -1007,6 +1007,9 @@ PWINE_ACMLOCALDRIVERINST MSACM_OpenLocalDriver(PWINE_ACMLOCALDRIVER paldrv, LPAR
     PWINE_ACMLOCALDRIVERINST pDrvInst;
     
     pDrvInst = HeapAlloc(MSACM_hHeap, 0, sizeof(WINE_ACMLOCALDRIVERINST));
+    if (!pDrvInst)
+        return NULL;
+
     pDrvInst->pLocalDriver = paldrv;
     pDrvInst->dwDriverID = 0;
     pDrvInst->pNextACMInst = NULL;
@@ -1028,9 +1031,14 @@ PWINE_ACMLOCALDRIVERINST MSACM_OpenLocalDriver(PWINE_ACMLOCALDRIVER paldrv, LPAR
         ret = MSACM_OpenLocalDriver(paldrv, lParam2);
         if (!ret)
         {
-            MSACM_CloseLocalDriver(pDrvInst);
             ERR("load1 failed\n");
-            goto exit;
+            /* If MSACM_CloseLocalDriver returns TRUE,
+             * then pDrvInst has been freed
+             */
+            if (!MSACM_CloseLocalDriver(pDrvInst))
+                goto exit;
+
+            return NULL;
         }
         pDrvInst->bSession = TRUE;
         return ret;