From b2fa124766a4ce58e9efc8997af4762c6d863d39 Mon Sep 17 00:00:00 2001
From: Thomas Faber <thomas.faber@reactos.org>
Date: Wed, 22 Aug 2012 09:39:57 +0000
Subject: [PATCH] [DEVMGR] - Actually fail on error in AllocAndLoadStringsCat
 (CID 716793/716794) [IPHLPAPI] - Fix a use after free in
 getNthInterfaceEntity (CID 716795 - partly reverts r53190). Fix a possible
 double free in getArpTable (CID 716796).

svn path=/trunk/; revision=57127
---
 reactos/dll/win32/devmgr/misc.c              |  1 +
 reactos/dll/win32/iphlpapi/ifenum_reactos.c  |  4 ++--
 reactos/dll/win32/iphlpapi/ipstats_reactos.c | 13 ++++++-------
 3 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/reactos/dll/win32/devmgr/misc.c b/reactos/dll/win32/devmgr/misc.c
index 4807bb0c3de..9723fb782de 100644
--- a/reactos/dll/win32/devmgr/misc.c
+++ b/reactos/dll/win32/devmgr/misc.c
@@ -130,6 +130,7 @@ AllocAndLoadStringsCat(OUT LPWSTR *lpTarget,
                 if (!(Ret = LoadStringW(hInst, uID[i], s, ln)))
                 {
                     LocalFree((HLOCAL)(*lpTarget));
+                    return 0;
                 }
 
                 s += Ret;
diff --git a/reactos/dll/win32/iphlpapi/ifenum_reactos.c b/reactos/dll/win32/iphlpapi/ifenum_reactos.c
index fd6c787304d..fcaa9d026b3 100644
--- a/reactos/dll/win32/iphlpapi/ifenum_reactos.c
+++ b/reactos/dll/win32/iphlpapi/ifenum_reactos.c
@@ -287,12 +287,12 @@ DWORD getNthInterfaceEntity( HANDLE tcpFile, DWORD index, TDIEntityID *ent ) {
     TRACE("Index %d is entity #%d - %04x:%08x\n", index, i,
            entitySet[i].tei_entity, entitySet[i].tei_instance );
 
-    tdiFreeThingSet( entitySet );
-
     if( numInterfaces == index && i < numEntities ) {
         memcpy( ent, &entitySet[i], sizeof(*ent) );
+        tdiFreeThingSet( entitySet );
         return STATUS_SUCCESS;
     } else {
+        tdiFreeThingSet( entitySet );
         return STATUS_UNSUCCESSFUL;
     }
 }
diff --git a/reactos/dll/win32/iphlpapi/ipstats_reactos.c b/reactos/dll/win32/iphlpapi/ipstats_reactos.c
index 4f732f5cfc4..656e00a87de 100644
--- a/reactos/dll/win32/iphlpapi/ipstats_reactos.c
+++ b/reactos/dll/win32/iphlpapi/ipstats_reactos.c
@@ -582,13 +582,12 @@ PMIB_IPNETTABLE getArpTable(void)
 					(PVOID *)&AdapterArpTable,
 					&returnSize );
 
-	    if( status == STATUS_SUCCESS ) {
-		for( TmpIdx = 0; TmpIdx < returnSize; TmpIdx++, CurrIdx++ )
-		    IpArpTable->table[CurrIdx] = AdapterArpTable[TmpIdx];
-	    }
-
-	    if( AdapterArpTable ) tdiFreeThingSet( AdapterArpTable );
-	}
+            if( status == STATUS_SUCCESS ) {
+                for( TmpIdx = 0; TmpIdx < returnSize; TmpIdx++, CurrIdx++ )
+                    IpArpTable->table[CurrIdx] = AdapterArpTable[TmpIdx];
+                tdiFreeThingSet( AdapterArpTable );
+            }
+        }
     }
 
     closeTcpFile( tcpFile );