From 7cb411e88fa68419c2cce8a3eb544945bd4af095 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Herm=C3=A8s=20B=C3=A9lusca-Ma=C3=AFto?=
 <hermes.belusca-maito@reactos.org>
Date: Sat, 9 Jun 2018 15:37:54 +0200
Subject: [PATCH] [USERSRV] HardError: Free WindowTitleU buffer only if we
 really allocated it.

---
 win32ss/user/winsrv/usersrv/harderror.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/win32ss/user/winsrv/usersrv/harderror.c b/win32ss/user/winsrv/usersrv/harderror.c
index 7cc3a67ca40..85ef9fe23d4 100644
--- a/win32ss/user/winsrv/usersrv/harderror.c
+++ b/win32ss/user/winsrv/usersrv/harderror.c
@@ -641,8 +641,10 @@ UserpFormatMessages(
     CaptionStringU->Length = (USHORT)(wcslen(CaptionStringU->Buffer) * sizeof(WCHAR));
 
     /* Free the strings if needed */
-    if (WindowTitleU.Buffer) RtlFreeUnicodeString(&WindowTitleU);
-    if (hProcess) RtlFreeUnicodeString(&FileNameU);
+    if (WindowTitleU.Buffer && (WindowTitleU.MaximumLength != 0))
+        RtlFreeUnicodeString(&WindowTitleU);
+    if (hProcess)
+        RtlFreeUnicodeString(&FileNameU);
 
     Format2A.Buffer = NULL;