Fixing a couple of issues in sandbox::RestrictedToken:

sandbox/win/src/restricted_token.cc

Index: sandbox/win/src/restricted_token.cc
diff --git a/sandbox/win/src/restricted_token.cc b/sandbox/win/src/restricted_token.cc
index 8a096a17f4509a8a4b0f9ee7f83dcc493aae70d8..57173da6e4574dfdab9b0774959a0483285f47e7 100644
--- a/sandbox/win/src/restricted_token.cc
+++ b/sandbox/win/src/restricted_token.cc
@@ -26,9 +26,9 @@ unsigned RestrictedToken::Init(const HANDLE effective_token) {
                           effective_token,
                           ::GetCurrentProcess(),
                           &effective_token_dup,
-                          DUPLICATE_SAME_ACCESS,
+                          0,
                           FALSE,
-                          0)) {  // no special options
+                          DUPLICATE_SAME_ACCESS)) {
       effective_token_ = effective_token_dup;
     } else {
       return ::GetLastError();
@@ -263,13 +263,16 @@ unsigned RestrictedToken::AddUserSidForDenyOnly() {
                                       size,
                                       &size);
 
-  Sid user = reinterpret_cast<SID*>(token_user->User.Sid);
-  delete[] reinterpret_cast<BYTE*>(token_user);
-
-  if (!result)
+  if (!result) {
+    delete[] reinterpret_cast<BYTE*>(token_user);
     return ::GetLastError();
+  }
 
+  Sid user = reinterpret_cast<SID*>(token_user->User.Sid);
   sids_for_deny_only_.push_back(user);
+
+  delete[] reinterpret_cast<BYTE*>(token_user);
+
   return ERROR_SUCCESS;
 }
 
@@ -323,6 +326,7 @@ unsigned RestrictedToken::DeleteAllPrivileges(
   }
 
   delete[] reinterpret_cast<BYTE *>(token_privileges);
+
   return ERROR_SUCCESS;
 }
 
@@ -406,14 +410,16 @@ unsigned RestrictedToken::AddRestrictingSidCurrentUser() {
                                       size,
                                       &size);
 
-  Sid user = reinterpret_cast<SID*>(token_user->User.Sid);
-  delete[] reinterpret_cast<BYTE*>(token_user);
-
-
-  if (!result)
+  if (!result) {
+    delete[] reinterpret_cast<BYTE*>(token_user);
     return ::GetLastError();
+  }
 
+  Sid user = reinterpret_cast<SID*>(token_user->User.Sid);
   sids_to_restrict_.push_back(user);
+
+  delete[] reinterpret_cast<BYTE*>(token_user);
+
   return ERROR_SUCCESS;
 }