Esme Povirk (@madewokherd) commented about dlls/windowscodecs/metadataquery.c:
+ if (!(objects = calloc(count, sizeof(*objects)))) + return E_OUTOFMEMORY; + + if (SUCCEEDED(hr = IEnumUnknown_Next(enumerator->object_enumerator, count, objects, fetched))) + { + for (ULONG i = 0; i < *fetched; ++i) + { + index = 0; + hr = string_enumerator_update_guid_index(enumerator, &guid, &index, objects[i]); + if (FAILED(hr)) break; + + if (!(str = CoTaskMemAlloc(64 * sizeof(WCHAR)))) + { + hr = E_OUTOFMEMORY; + break; + } I don't think the error path here quite works. If we exit the loop early, `*fetched` will be the number of IUnknown pointers we got from `object_enumerator`, but we won't return that many items in `strings`.
-- https://gitlab.winehq.org/wine/wine/-/merge_requests/7407#note_96327