wm_paint crashing 2nd time round

[lld4rkll]

greetings everyone. im new to win32 and this is a problem i have encountered with my first program.

currently everything works until LBN_SELCHANGE is accessed and the window attempts to repaint. this leads me to think that i have missed out something important in WM_PAINT.

i have tried free(filename); at the end of WM_PAINT but it has caused my program to crash immediately instead.

can somebody please vet my code and tell me what's wrong? my apologies if it's an obvious mistake due to my inexperience.

thank you for your time.

int index;
        int length;
        TCHAR *filename;
 
        switch(Msg)
        {
        case WM_CREATE: {
                hList = CreateWindowEx(WS_EX_CLIENTEDGE, L"Listbox", L"", WS_CHILD | WS_VISIBLE | LBS_NOTIFY | LBS_HASSTRINGS, 338, 0, 150, 275, hWnd,  
               (HMENU)IDC_LIST, GetModuleHandle(NULL), NULL);
                
                WIN32_FIND_DATA FindData;
                HANDLE hFile = FindFirstFile(L"*.bmp", &FindData);
                
                index = SendMessage(hList, LB_ADDSTRING, 0, (LPARAM)FindData.cFileName);           //
                while(FindNextFile(hFile, &FindData)) {                                            //populate listbox with filenames
                        index = SendMessage(hList, LB_ADDSTRING, 0, (LPARAM)FindData.cFileName);   //
                }
                index = SendMessage(hList, LB_GETTOPINDEX, 0, 0);   //
                SendMessage(hList, LB_SETCURSEL, (WPARAM)index, 0); // select topmost item 
                
                break;
                }
 
        case WM_PAINT: {
                index = SendMessage(hList, LB_GETCURSEL, 0, 0); //get index of selected item(1st item 1st time through)
                length = SendMessage(hList, LB_GETTEXTLEN, (WPARAM)index, 0); //get length of text
                filename = (TCHAR*) malloc (length + 1);
                SendMessage (hList, LB_GETTEXT, (WPARAM)index, (LPARAM)filename); //get filename
                
                SetWindowText(hWnd, filename); //just a convenient test to see if text was retrieved from list
                
                break;
                }
 
        case WM_COMMAND: {
                switch(LOWORD(wParam)) {
            case IDC_LIST:
                switch(HIWORD(wParam)) {
                                        
                    case LBN_SELCHANGE:
                             SendMessage(hWnd, WM_PAINT, 0, 0); 
                             break;
                }
            break;
            }
                break;
                }