[WIN32K] Fix 'use after free' in NtGdiStretchDIBitsInternal (#4122)

CORE-17861

win32ss/gdi/ntgdi/dibobj.c

@@ -1489,7 +1489,6 @@ NtGdiStretchDIBitsInternal(
         if (pdc) DC_UnlockDc(pdc);
     }
 
-    if (pbmiSafe) ExFreePoolWithTag(pbmiSafe, 'imBG');
     if (pvBits) ExFreePoolWithTag(pvBits, TAG_DIB);
 
     /* This is not what MSDN says is returned from this function, but it
@@ -1504,6 +1503,8 @@ NtGdiStretchDIBitsInternal(
         LinesCopied = pbmiSafe->bmiHeader.biHeight;
     }
 
+    ExFreePoolWithTag(pbmiSafe, 'imBG');
+
     return LinesCopied;
 }