Zhiyi Zhang : atl: Avoid NULL pointer reference in AtlComModuleRevokeClassObjects().

[Alexandre Julliard]

Module: wine
Branch: master
Commit: 2f3b916d05f6f2cd092f228645a0eb8bca5a1b2e
URL:    https://source.winehq.org/git/wine.git/?a=commit;h=2f3b916d05f6f2cd092f22864...

Author: Zhiyi Zhang <zzhang(a)codeweavers.com>
Date:   Fri Jul  1 12:31:34 2022 +0800

atl: Avoid NULL pointer reference in AtlComModuleRevokeClassObjects().

Signed-off-by: Zhiyi Zhang <zzhang(a)codeweavers.com>

---

 dlls/atl/atl.c          |  6 ++++++
 dlls/atl100/tests/atl.c | 26 ++++++++++++++++++++++++++
 dlls/atl110/tests/atl.c | 26 ++++++++++++++++++++++++++
 3 files changed, 58 insertions(+)

diff --git a/dlls/atl/atl.c b/dlls/atl/atl.c
index 5a302621d60..32e0c722f8b 100644
--- a/dlls/atl/atl.c
+++ b/dlls/atl/atl.c
@@ -598,6 +598,9 @@ HRESULT WINAPI AtlComModuleRevokeClassObjects(_ATL_COM_MODULE *module)
         return E_INVALIDARG;
 
     for(iter = module->m_ppAutoObjMapFirst; iter < module->m_ppAutoObjMapLast; iter++) {
+        if(!(*iter))
+            continue;
+
         hres = CoRevokeClassObject((*iter)->dwRegister);
         if(FAILED(hres))
             return hres;
@@ -617,6 +620,9 @@ HRESULT WINAPI AtlComModuleRevokeClassObjects(_ATL_COM_MODULE *module)
         return E_INVALIDARG;
 
     for(iter = module->m_ppAutoObjMapFirst; iter < module->m_ppAutoObjMapLast; iter++) {
+        if(!(*iter))
+            continue;
+
         hres = CoRevokeClassObject((*iter)->pCache->dwRegister);
         if(FAILED(hres))
             return hres;
diff --git a/dlls/atl100/tests/atl.c b/dlls/atl100/tests/atl.c
index 7da6e5a9cd6..a40c38df25a 100644
--- a/dlls/atl100/tests/atl.c
+++ b/dlls/atl100/tests/atl.c
@@ -1115,6 +1115,31 @@ static void test_AtlComModuleRegisterClassObjects(void)
     ok(hr == S_FALSE, "Unexpected hr %#lx.\n", hr);
 }
 
+static void test_AtlComModuleRevokeClassObjects(void)
+{
+    _ATL_OBJMAP_ENTRY *null_entry = NULL;
+    _ATL_COM_MODULE module;
+    HRESULT hr;
+
+    /* Test NULL module */
+    hr = AtlComModuleRevokeClassObjects(NULL);
+    ok(hr == E_INVALIDARG, "Unexpected hr %#lx.\n", hr);
+
+    /* Test NULL m_ppAutoObjMapFirst and m_ppAutoObjMapLast */
+    module.cbSize = sizeof(module);
+    module.m_ppAutoObjMapFirst = NULL;
+    module.m_ppAutoObjMapLast = NULL;
+    hr = AtlComModuleRevokeClassObjects(&module);
+    ok(hr == S_OK, "Unexpected hr %#lx.\n", hr);
+
+    /* Test m_ppAutoObjMapFirst and m_ppAutoObjMapLast both pointing to a NULL entry */
+    module.cbSize = sizeof(module);
+    module.m_ppAutoObjMapFirst = &null_entry;
+    module.m_ppAutoObjMapLast = &null_entry;
+    hr = AtlComModuleRevokeClassObjects(&module);
+    ok(hr == S_OK, "Unexpected hr %#lx.\n", hr);
+}
+
 START_TEST(atl)
 {
     if (!register_class())
@@ -1132,6 +1157,7 @@ START_TEST(atl)
     test_AtlAxCreateControl();
     test_AtlComModuleGetClassObject();
     test_AtlComModuleRegisterClassObjects();
+    test_AtlComModuleRevokeClassObjects();
 
     CoUninitialize();
 }
diff --git a/dlls/atl110/tests/atl.c b/dlls/atl110/tests/atl.c
index 9e4bad87e97..ba5639178c3 100644
--- a/dlls/atl110/tests/atl.c
+++ b/dlls/atl110/tests/atl.c
@@ -82,12 +82,38 @@ static void test_AtlComModuleRegisterClassObjects(void)
     ok(hr == S_FALSE, "Unexpected hr %#lx.\n", hr);
 }
 
+static void test_AtlComModuleRevokeClassObjects(void)
+{
+    _ATL_OBJMAP_ENTRY_EX *null_entry = NULL;
+    _ATL_COM_MODULE module;
+    HRESULT hr;
+
+    /* Test NULL module */
+    hr = AtlComModuleRevokeClassObjects(NULL);
+    ok(hr == E_INVALIDARG, "Unexpected hr %#lx.\n", hr);
+
+    /* Test NULL m_ppAutoObjMapFirst and m_ppAutoObjMapLast */
+    module.cbSize = sizeof(module);
+    module.m_ppAutoObjMapFirst = NULL;
+    module.m_ppAutoObjMapLast = NULL;
+    hr = AtlComModuleRevokeClassObjects(&module);
+    ok(hr == S_OK, "Unexpected hr %#lx.\n", hr);
+
+    /* Test m_ppAutoObjMapFirst and m_ppAutoObjMapLast both pointing to a NULL entry */
+    module.cbSize = sizeof(module);
+    module.m_ppAutoObjMapFirst = &null_entry;
+    module.m_ppAutoObjMapLast = &null_entry;
+    hr = AtlComModuleRevokeClassObjects(&module);
+    ok(hr == S_OK, "Unexpected hr %#lx.\n", hr);
+}
+
 START_TEST(atl)
 {
     CoInitialize(NULL);
 
     test_AtlComModuleGetClassObject();
     test_AtlComModuleRegisterClassObjects();
+    test_AtlComModuleRevokeClassObjects();
 
     CoUninitialize();
 }