Crash Modifying Property on Moved Item

[stephenegriffin]

Find a message
Open stream prop on message (PR_HTML)
From Outlook or somewhere else, move the message to another folder
OK or cancel on stream prop editing
Result:
Crash on null property bag
Expected:
no crash

[stephenegriffin]

propbag deletion in action:

MFCMapi.exe!propertybag::mapiPropPropertyBag::~mapiPropPropertyBag() Line 19	
MFCMapi.exe!propertybag::mapiPropPropertyBag::`scalar deleting destructor'(unsigned int)	
MFCMapi.exe!std::_Destroy_in_place<propertybag::mapiPropPropertyBag>(propertybag::mapiPropPropertyBag & _Obj) Line 242	
MFCMapi.exe!std::_Ref_count_obj2<propertybag::mapiPropPropertyBag>::_Destroy() Line 1499	
MFCMapi.exe!std::_Ref_count_base::_Decref() Line 648	
MFCMapi.exe!std::shared_ptr<propertybag::IMAPIPropertyBag>::operator=(const std::shared_ptr<propertybag::IMAPIPropertyBag> & _Right) Line 1134	
MFCMapi.exe!controls::sortlistctrl::CSingleMAPIPropListCtrl::SetDataSource(const std::shared_ptr<propertybag::IMAPIPropertyBag> lpPropBag, bool bIsAB) Line 752	
MFCMapi.exe!controls::sortlistctrl::CSingleMAPIPropListCtrl::SetDataSource(IMAPIProp * lpMAPIProp, sortlistdata::sortListData * lpListData, bool bIsAB) Line 733	
MFCMapi.exe!`dialog::CBaseDialog::OnUpdateSingleMAPIPropListCtrl'::`5'::<lambda_1>::operator()() Line 465	
MFCMapi.exe!dialog::CBaseDialog::OnUpdateSingleMAPIPropListCtrl(IMAPIProp * lpMAPIProp, sortlistdata::sortListData * lpListData) Line 467	
MFCMapi.exe!controls::sortlistctrl::CContentsTableListCtrl::OnItemChanged(tagNMHDR * pNMHDR, long * pResult) Line 1251	
...
user32.dll!77ad9e6d()	Unknown
MFCMapi.exe!CListCtrl::DeleteItem(int nItem) Line 169	
MFCMapi.exe!`controls::sortlistctrl::CContentsTableListCtrl::msgOnDeleteItem'::`2'::<lambda_1>::operator()() Line 1533	
MFCMapi.exe!controls::sortlistctrl::CContentsTableListCtrl::msgOnDeleteItem(unsigned int wParam, long __formal) Line 1533	
MFCMapi.exe!CWnd::OnWndMsg(unsigned int message, unsigned int wParam, long lParam, long * pResult) Line 2441	
...
MFCMapi.exe!AfxPumpMessage() Line 190	
MFCMapi.exe!CWnd::RunModalLoop(unsigned long dwFlags) Line 4661	
MFCMapi.exe!CWnd::CreateRunDlgIndirect(const DLGTEMPLATE * lpDialogTemplate, CWnd * pParentWnd, HINSTANCE__ * hInst) Line 470	
MFCMapi.exe!CDialog::DoModal() Line 633	
MFCMapi.exe!`dialog::editor::CEditor::DisplayDialog'::`2'::<lambda_1>::operator()() Line 506	
MFCMapi.exe!dialog::editor::CEditor::DisplayDialog() Line 506	
MFCMapi.exe!dialog::editor::DisplayPropertyEditor(CWnd * pParentWnd, unsigned int uidTitle, unsigned int uidPrompt, bool bIsAB, void * lpAllocParent, IMAPIProp * lpMAPIProp, unsigned long ulPropTag, bool bMVRow, const _SPropValue * lpsPropValue, _SPropValue * * lpNewValue) Line 86	
MFCMapi.exe!`controls::sortlistctrl::CSingleMAPIPropListCtrl::OnEditGivenProp'::`28'::<lambda_4>::operator()() Line 1389	
MFCMapi.exe!controls::sortlistctrl::CSingleMAPIPropListCtrl::OnEditGivenProp(unsigned long ulPropTag) Line 1389	
MFCMapi.exe!controls::sortlistctrl::CSingleMAPIPropListCtrl::OnEditProp() Line 1256	
MFCMapi.exe!controls::sortlistctrl::CSingleMAPIPropListCtrl::OnDblclk(tagNMHDR * __formal, long * pResult) Line 939	

[stephenegriffin]

Crash

MFCMapi.exe!controls::sortlistctrl::CSingleMAPIPropListCtrl::OnEditGivenProp(unsigned long ulPropTag) Line 1415
MFCMapi.exe!controls::sortlistctrl::CSingleMAPIPropListCtrl::OnEditProp() Line 1256
MFCMapi.exe!controls::sortlistctrl::CSingleMAPIPropListCtrl::OnDblclk(tagNMHDR * __formal, long * pResult) Line 939

   m_lpPropBag->FreeBuffer(lpEditProp);

[stephenegriffin]

We could just null check here, but then we risk leaking lpEditProp.
CPropertyEditor holds the propval, or else we could do init/delete/display and not care if the propbag disappears.

Perhaps the propbag could hand over an object that will do proper free (if needed) on destruct. Then caller can own the object independent of propbag...