Added patch to fix leak and use-after-free in winecfg theming implementation.

debian/changelog

@@ -5,6 +5,8 @@ wine-staging (1.7.49) UNRELEASED; urgency=low
   * Added patch with stubs for additional wininet options in InternetSetOption
     (fixes Wine Staging Bug #443).
   * Added patch to implement stub for vcomp._vcomp_flush.
+  * Added patch to fix leak and use-after-free in winecfg theming
+    implementation.
   * Removed patch to avoid race-conditions with long running threadpool tasks
     (accepted upstream).
   * Removed patch to add support for ThreadQuerySetWin32StartAddress info class

patches/patchinstall.sh

@@ -250,6 +250,7 @@ patch_enable_all ()
 	enable_wineboot_drivers_etc_Stubs="$1"
 	enable_winecfg_Libraries="$1"
 	enable_winecfg_Staging="$1"
+	enable_winecfg_Theme_Leak="$1"
 	enable_winecfg_Unmounted_Devices="$1"
 	enable_wineconsole_Forward_Exitcode="$1"
 	enable_wined3d_Accounting="$1"
@@ -827,6 +828,9 @@ patch_enable ()
 		winecfg-Staging)
 			enable_winecfg_Staging="$2"
 			;;
+		winecfg-Theme_Leak)
+			enable_winecfg_Theme_Leak="$2"
+			;;
 		winecfg-Unmounted_Devices)
 			enable_winecfg_Unmounted_Devices="$2"
 			;;
@@ -4873,6 +4877,18 @@ if test "$enable_winecfg_Libraries" -eq 1; then
 	) >> "$patchlist"
 fi
 
+# Patchset winecfg-Theme_Leak
+# |
+# | Modified files:
+# |   *	programs/winecfg/theme.c
+# |
+if test "$enable_winecfg_Theme_Leak" -eq 1; then
+	patch_apply winecfg-Theme_Leak/0001-winecfg-Do-not-overwrite-theme-each-time-an-item-is-.patch
+	(
+		echo '+    { "Michael Müller", "winecfg: Do not overwrite theme each time an item is drawn.", 1 },';
+	) >> "$patchlist"
+fi
+
 # Patchset winecfg-Unmounted_Devices
 # |
 # | Modified files:
@@ -4921,6 +4937,18 @@ if test "$enable_wined3d_CSMT_Helper" -eq 1; then
 	) >> "$patchlist"
 fi
 
+# Patchset wined3d-UnhandledBlendFactor
+# |
+# | Modified files:
+# |   *	dlls/wined3d/state.c
+# |
+if test "$enable_wined3d_UnhandledBlendFactor" -eq 1; then
+	patch_apply wined3d-UnhandledBlendFactor/0001-wined3d-Silence-repeated-Unhandled-blend-factor-0-me.patch
+	(
+		echo '+    { "Sebastian Lackner", "wined3d: Silence repeated '\''Unhandled blend factor 0'\'' messages.", 1 },';
+	) >> "$patchlist"
+fi
+
 # Patchset wined3d-resource_check_usage
 # |
 # | Modified files:
@@ -5020,18 +5048,6 @@ if test "$enable_wined3d_Revert_PixelFormat" -eq 1; then
 	) >> "$patchlist"
 fi
 
-# Patchset wined3d-UnhandledBlendFactor
-# |
-# | Modified files:
-# |   *	dlls/wined3d/state.c
-# |
-if test "$enable_wined3d_UnhandledBlendFactor" -eq 1; then
-	patch_apply wined3d-UnhandledBlendFactor/0001-wined3d-Silence-repeated-Unhandled-blend-factor-0-me.patch
-	(
-		echo '+    { "Sebastian Lackner", "wined3d: Silence repeated '\''Unhandled blend factor 0'\'' messages.", 1 },';
-	) >> "$patchlist"
-fi
-
 # Patchset wined3d-CSMT_Main
 # |
 # | This patchset fixes the following Wine bugs:

patches/winecfg-Theme_Leak/0001-winecfg-Do-not-overwrite-theme-each-time-an-item-is-.patch

@@ -0,0 +1,26 @@
+From 13a30e3966820c04e76e48182e7c2b9a979ecc17 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Michael=20M=C3=BCller?= <michael@fds-team.de>
+Date: Sat, 8 Aug 2015 00:52:36 +0200
+Subject: winecfg: Do not overwrite theme each time an item is drawn.
+
+Fixes a leak and a use-after-free.
+---
+ programs/winecfg/theme.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/programs/winecfg/theme.c b/programs/winecfg/theme.c
+index 8bc3c88..1f4818b 100644
+--- a/programs/winecfg/theme.c
++++ b/programs/winecfg/theme.c
+@@ -1094,7 +1094,7 @@ static void on_draw_item(HWND hDlg, WPARAM wParam, LPARAM lParam)
+         HTHEME theme;
+         RECT buttonrect;
+ 
+-        theme = OpenThemeData(draw_info->hwndItem, WC_BUTTONW);
++        theme = OpenThemeData(NULL, WC_BUTTONW);
+ 
+         if (theme) {
+             MARGINS margins;
+-- 
+2.5.0
+