From ece6628139cdc8af4490ff17de1d0e97a34debbb Mon Sep 17 00:00:00 2001
From: Pierre Schweitzer <pierre@reactos.org>
Date: Sat, 5 Apr 2014 21:08:10 +0000
Subject: [PATCH] [MMEBUDDY] Fix use after free.

CID #716804

svn path=/trunk/; revision=62632
---
 reactos/lib/drivers/sound/mmebuddy/deviceinstance.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/reactos/lib/drivers/sound/mmebuddy/deviceinstance.c b/reactos/lib/drivers/sound/mmebuddy/deviceinstance.c
index 33f23e3105f..2e34aa6dc4c 100644
--- a/reactos/lib/drivers/sound/mmebuddy/deviceinstance.c
+++ b/reactos/lib/drivers/sound/mmebuddy/deviceinstance.c
@@ -306,15 +306,16 @@ DestroyAllSoundDeviceInstances(
     IN  PSOUND_DEVICE SoundDevice)
 {
     MMRESULT Result;
-    PSOUND_DEVICE_INSTANCE SoundDeviceInstance;
+    PSOUND_DEVICE_INSTANCE SoundDeviceInstance, NextDeviceInstance;
 
     SoundDeviceInstance = SoundDevice->HeadInstance;
 
     while ( SoundDeviceInstance )
     {
+        NextDeviceInstance = SoundDeviceInstance->Next;
         Result = DestroySoundDeviceInstance(SoundDeviceInstance);
         SND_ASSERT( MMSUCCESS(Result) );
-        SoundDeviceInstance = SoundDeviceInstance->Next;
+        SoundDeviceInstance = NextDeviceInstance;
     }
 
     return MMSYSERR_NOERROR;