From 3fe36f5bb9f7f47af52d3fc7814ac9d7bc9cac69 Mon Sep 17 00:00:00 2001
From: Mark Jansen <mark.jansen@reactos.org>
Date: Wed, 13 Jul 2016 18:02:16 +0000
Subject: [PATCH] [APPHELP] Dereference after null check (default_dir). CID
 1363509

svn path=/trunk/; revision=71931
---
 reactos/dll/appcompat/apphelp/sdbapi.c | 19 ++++++++++++-------
 1 file changed, 12 insertions(+), 7 deletions(-)

diff --git a/reactos/dll/appcompat/apphelp/sdbapi.c b/reactos/dll/appcompat/apphelp/sdbapi.c
index 4d5b647b67a..4f3d5964c2f 100644
--- a/reactos/dll/appcompat/apphelp/sdbapi.c
+++ b/reactos/dll/appcompat/apphelp/sdbapi.c
@@ -472,31 +472,36 @@ BOOL WINAPI SdbGetAppPatchDir(HSDB db, LPWSTR path, DWORD size)
     static WCHAR* default_dir = NULL;
     static CONST WCHAR szAppPatch[] = {'\\','A','p','p','P','a','t','c','h',0};
 
-    if(!default_dir)
+    /* In case function fails, path holds empty string */
+    if (size > 0)
+        *path = 0;
+
+    if (!default_dir)
     {
         WCHAR* tmp = NULL;
         UINT len = GetSystemWindowsDirectoryW(NULL, 0) + lstrlenW(szAppPatch);
         tmp = SdbAlloc((len + 1)* sizeof(WCHAR));
-        if(tmp)
+        if (tmp)
         {
             UINT r = GetSystemWindowsDirectoryW(tmp, len+1);
             if (r && r < len)
             {
                 if (SUCCEEDED(StringCchCatW(tmp, len+1, szAppPatch)))
                 {
-                    if(InterlockedCompareExchangePointer((void**)&default_dir, tmp, NULL) == NULL)
+                    if (InterlockedCompareExchangePointer((void**)&default_dir, tmp, NULL) == NULL)
                         tmp = NULL;
                 }
             }
             if (tmp)
                 SdbFree(tmp);
         }
+        if (!default_dir)
+        {
+            SHIM_ERR("Unable to obtain default AppPatch directory\n");
+            return FALSE;
+        }
     }
 
-    /* In case function fails, path holds empty string */
-    if (size > 0)
-        *path = 0;
-
     if (!db)
     {
         return SUCCEEDED(StringCchCopyW(path, size, default_dir));