Nikolay Sivov (@nsivov) commented about dlls/uiautomationcore/uia_com_client.c:
+ VariantInit(&v); + hr = UiaGetPropertyValue(element->node, UIA_BoundingRectanglePropertyId, &v); + if (SUCCEEDED(hr) && V_VT(&v) == (VT_R8 | VT_ARRAY)) + { + double vals[4]; + LONG idx; + + for (idx = 0; idx < ARRAY_SIZE(vals); idx++) + SafeArrayGetElement(V_ARRAY(&v), &idx, &vals[idx]); + + ret_val->left = vals[0]; + ret_val->top = vals[1]; + ret_val->right = ret_val->left + vals[2]; + ret_val->bottom = ret_val->top + vals[3]; + VariantClear(&v); + } Similarly here, but also might be worth doing a bounds check. Can this data come from some custom source?
-- https://gitlab.winehq.org/wine/wine/-/merge_requests/2248#note_25001