From 26adc0c6bf1e4aafe6dc261f8aca09636ca63912 Mon Sep 17 00:00:00 2001
From: Sean Hall <r.sean.hall@gmail.com>
Date: Sun, 19 Feb 2023 21:38:21 -0600
Subject: Fix double-free bugs in thmutil.

Fixes 7231
---
 src/libs/dutil/WixToolset.DUtil/thmutil.cpp        |  6 ++---
 .../theme/BafThmUtilTestingTheme.xml               | 27 ++++++++++++++++++++++
 .../theme/BafThmUtilTestingThemeLoose.xml          | 27 ++++++++++++++++++++++
 3 files changed, 57 insertions(+), 3 deletions(-)

diff --git a/src/libs/dutil/WixToolset.DUtil/thmutil.cpp b/src/libs/dutil/WixToolset.DUtil/thmutil.cpp
index 7bd98a1a..7938cd0b 100644
--- a/src/libs/dutil/WixToolset.DUtil/thmutil.cpp
+++ b/src/libs/dutil/WixToolset.DUtil/thmutil.cpp
@@ -3752,7 +3752,7 @@ static HRESULT ParseActions(
 
             ++i;
             ReleaseNullBSTR(bstrType);
-            ReleaseObject(pixnChild);
+            ReleaseNullObject(pixnChild);
         }
     }
 
@@ -3984,8 +3984,8 @@ static HRESULT ParseRadioButtons(
             pControl->fLastRadioButton = TRUE;
         }
 
-        ReleaseObject(pixnl);
-        ReleaseObject(pixnRadioButtons);
+        ReleaseNullObject(pixnl);
+        ReleaseNullObject(pixnRadioButtons);
     }
 
 LExit:
diff --git a/src/test/burn/TestData/Manual/BafThmutilTesting/theme/BafThmUtilTestingTheme.xml b/src/test/burn/TestData/Manual/BafThmutilTesting/theme/BafThmUtilTestingTheme.xml
index c890d7df..a5198a13 100644
--- a/src/test/burn/TestData/Manual/BafThmutilTesting/theme/BafThmUtilTestingTheme.xml
+++ b/src/test/burn/TestData/Manual/BafThmutilTesting/theme/BafThmUtilTestingTheme.xml
@@ -160,6 +160,33 @@ There are currently four states for a button: default, focus, hover, and selecte
                 <Text>Back</Text>
                 <ChangePageAction Page="Progressbar" />
             </Button>
+            <Button Name="RadioButtonsButton" X="-183" Y="-11" Width="75" Height="23" TabStop="yes" FontId="Default">
+                <Text>Next</Text>
+                <ChangePageAction Page="RadioButtons" />
+            </Button>
+        </Page>
+        <Page Name="RadioButtons">
+            <Label X="6" Y="6" Width="-6" Height="43" FontId="Default">
+                This page has two groups of radio buttons. Only one value should be able to be selected for each group. A value should be able to be selected for both groups.
+            </Label>
+            <Label X="6" Y="50" Width="-6" Height="13" FontId="Default">
+                Choice #1:
+            </Label>
+            <RadioButtons Name="CHOICE">
+                <RadioButton Height="30" Width="30" X="33" Y="68" Value="1" />
+                <RadioButton Height="30" Width="30" X="33" Y="103" Value="2" />
+            </RadioButtons>
+            <Label X="6" Y="138" Width="-6" Height="13" FontId="Default">
+                Choice #2:
+            </Label>
+            <RadioButtons Name="CHOICE2">
+                <RadioButton Height="30" Width="130" X="33" Y="156" Value="1">One</RadioButton>
+                <RadioButton Height="30" Width="130" X="33" Y="191" Value="2">Two</RadioButton>
+            </RadioButtons>
+            <Button Name="RadioButtonsBackButton" X="-269" Y="-11" Width="75" Height="23" TabStop="yes" FontId="Default">
+                <Text>Back</Text>
+                <ChangePageAction Page="Billboard" />
+            </Button>
         </Page>
         <Button Name="StartButton" X="-97" Y="-11" Width="75" Height="23" TabStop="yes" FontId="Default" Visible="yes">
             <Text>Start</Text>
diff --git a/src/test/burn/TestData/Manual/BafThmutilTesting/theme/BafThmUtilTestingThemeLoose.xml b/src/test/burn/TestData/Manual/BafThmutilTesting/theme/BafThmUtilTestingThemeLoose.xml
index 37757e64..bb91d3ce 100644
--- a/src/test/burn/TestData/Manual/BafThmutilTesting/theme/BafThmUtilTestingThemeLoose.xml
+++ b/src/test/burn/TestData/Manual/BafThmutilTesting/theme/BafThmUtilTestingThemeLoose.xml
@@ -160,6 +160,33 @@ There are currently four states for a button: default, focus, hover, and selecte
                 <Text>Back</Text>
                 <ChangePageAction Page="Progressbar" />
             </Button>
+            <Button Name="RadioButtonsButton" X="-183" Y="-11" Width="75" Height="23" TabStop="yes" FontId="Default">
+                <Text>Next</Text>
+                <ChangePageAction Page="RadioButtons" />
+            </Button>
+        </Page>
+        <Page Name="RadioButtons">
+            <Label X="6" Y="6" Width="-6" Height="43" FontId="Default">
+                This page has two groups of radio buttons. Only one value should be able to be selected for each group. A value should be able to be selected for both groups.
+            </Label>
+            <Label X="6" Y="50" Width="-6" Height="13" FontId="Default">
+                Choice #1:
+            </Label>
+            <RadioButtons Name="CHOICE">
+                <RadioButton Height="30" Width="30" X="33" Y="68" Value="1" />
+                <RadioButton Height="30" Width="30" X="33" Y="103" Value="2" />
+            </RadioButtons>
+            <Label X="6" Y="138" Width="-6" Height="13" FontId="Default">
+                Choice #2:
+            </Label>
+            <RadioButtons Name="CHOICE2">
+                <RadioButton Height="30" Width="130" X="33" Y="156" Value="1">One</RadioButton>
+                <RadioButton Height="30" Width="130" X="33" Y="191" Value="2">Two</RadioButton>
+            </RadioButtons>
+            <Button Name="RadioButtonsBackButton" X="-269" Y="-11" Width="75" Height="23" TabStop="yes" FontId="Default">
+                <Text>Back</Text>
+                <ChangePageAction Page="Billboard" />
+            </Button>
         </Page>
         <Button Name="StartButton" X="-97" Y="-11" Width="75" Height="23" TabStop="yes" FontId="Default" Visible="yes">
             <Text>Start</Text>
-- 
cgit v1.2.3-55-g6feb