QWidgetPrivate::unregisterOleDnd may delete the dropTarget without setting the pointer to null leading to a crash

This is a Windows specific bug report (qwidget_win.cpp).

In the method below the dropTarget->Release() may delete the dropTarget if the ref count reaches zero. However later in the method dropTarget can be accessed in:

CoLockObjectExternal(dropTarget, false, true);

... which leads to a crash. So if the dropTarget->Release() returns 0 the dropTarget ptr should be set to 0 ?

void QWidgetPrivate::unregisterOleDnd(QWidget *widget, QOleDropTarget *dropTarget)
{
dropTarget->releaseQt();
dropTarget->Release();

Q_ASSERT(widget->testAttribute(Qt::WA_WState_Created));
if (!widget->internalWinId()) {
QWidget *nativeParent = widget->nativeParentWidget();
Q_ASSERT(nativeParent);
QWExtra *nativeExtra = nativeParent->d_func()->extra;
Q_ASSERT(nativeExtra);
nativeExtra->oleDropWidgets.removeAll(widget);
nativeExtra->oleDropWidgets.removeAll(static_cast<QWidget *>(0));
if (nativeExtra->oleDropWidgets.isEmpty() && nativeExtra->dropTarget
&& !nativeParent->testAttribute(Qt::WA_DropSiteRegistered))

{ #ifndef Q_OS_WINCE CoLockObjectExternal(nativeExtra->dropTarget, false, true); #endif RevokeDragDrop(nativeParent->internalWinId()); nativeExtra->dropTarget = 0; }

} else

{ #ifndef Q_OS_WINCE CoLockObjectExternal(dropTarget, false, true); #endif RevokeDragDrop(widget->internalWinId()); }

}