From 52f76a303d4ffe74c8ce3544a6325f95296dc912 Mon Sep 17 00:00:00 2001
From: Thomas Faber <thomas.faber@reactos.org>
Date: Fri, 31 Oct 2014 18:02:52 +0000
Subject: [PATCH] [SHELL32] - Fix a use after free in
 COpenWithMenu::Initialize. Powered by DPH.

svn path=/trunk/; revision=65156
---
 reactos/dll/win32/shell32/openwithmenu.cpp | 14 ++++++++------
 1 file changed, 8 insertions(+), 6 deletions(-)

diff --git a/reactos/dll/win32/shell32/openwithmenu.cpp b/reactos/dll/win32/shell32/openwithmenu.cpp
index a2033f819c6..93bdbf405fe 100644
--- a/reactos/dll/win32/shell32/openwithmenu.cpp
+++ b/reactos/dll/win32/shell32/openwithmenu.cpp
@@ -1334,6 +1334,14 @@ COpenWithMenu::Initialize(LPCITEMIDLIST pidlFolder,
     pidlFolder2 = (LPCITEMIDLIST) ((LPBYTE)pida + pida->aoffset[0]);
     pidlChild = (LPCITEMIDLIST) ((LPBYTE)pida + pida->aoffset[1]);
 
+    if (!_ILIsValue(pidlChild))
+    {
+        TRACE("pidl is not a file\n");
+        GlobalUnlock(medium.hGlobal);
+        GlobalFree(medium.hGlobal);
+        return E_FAIL;
+    }
+
     pidl = ILCombine(pidlFolder2, pidlChild);
 
     GlobalUnlock(medium.hGlobal);
@@ -1344,12 +1352,6 @@ COpenWithMenu::Initialize(LPCITEMIDLIST pidlFolder,
         ERR("no mem\n");
         return E_OUTOFMEMORY;
     }
-    if (!_ILIsValue(pidlChild))
-    {
-        TRACE("pidl is not a file\n");
-        SHFree((void*)pidl);
-        return E_FAIL;
-    }
 
     if (!SHGetPathFromIDListW(pidl, m_wszPath))
     {