Fixes to possible GetLastError bugs

sandbox/win/src/restricted_token_utils.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include <aclapi.h>
 #include <sddl.h>
 #include <vector>
 
 #include "sandbox/win/src/restricted_token_utils.h"
 
@@ skipping 200 matching lines @@
   if (!::ConvertStringSidToSid(integrity_level_str, &integrity_sid))
     return ::GetLastError();
 
   TOKEN_MANDATORY_LABEL label = {};
   label.Label.Attributes = SE_GROUP_INTEGRITY;
   label.Label.Sid = integrity_sid;
 
   DWORD size = sizeof(TOKEN_MANDATORY_LABEL) + ::GetLengthSid(integrity_sid);
   BOOL result = ::SetTokenInformation(token, TokenIntegrityLevel, &label,
                                       size);
+  auto last_error = ::GetLastError();
   ::LocalFree(integrity_sid);
 
-  return result ? ERROR_SUCCESS : ::GetLastError();
+  return result ? ERROR_SUCCESS : last_error;
 }
 
 DWORD SetProcessIntegrityLevel(IntegrityLevel integrity_level) {
   if (base::win::GetVersion() < base::win::VERSION_VISTA)
     return ERROR_SUCCESS;
 
   // We don't check for an invalid level here because we'll just let it
   // fail on the SetTokenIntegrityLevel call later on.
   if (integrity_level == INTEGRITY_LEVEL_LAST) {
     // No mandatory level specified, we don't change it.
@@ skipping 67 matching lines @@
   if (!::OpenProcessToken(GetCurrentProcess(), READ_CONTROL | WRITE_OWNER,
                           &token_handle))
     return ::GetLastError();
 
   base::win::ScopedHandle token(token_handle);
 
   return HardenTokenIntegrityLevelPolicy(token.Get());
 }
 
 }  // namespace sandbox