Re: [PATCH 0/4] MR8781: jscript: Misc array and toString fixes.

[Jacek Caban (＠jacek)]

Jacek Caban (@jacek) commented about dlls/jscript/function.c:
> +            hres = JS_E_JSCRIPT_EXPECTED;
> +        goto fail;
> +    }
> +
> +    if(FAILED(VariantChangeType(&var, &var, 0, VT_UI4))) {
> +        VariantClear(&var);
> +        hres = JS_E_JSCRIPT_EXPECTED;
> +        goto fail;
> +    }
> +    length = V_UI4(&var);
> +
> +    argv = malloc(length * sizeof(*argv));
> +    if(!argv) {
> +        hres = E_OUTOFMEMORY;
> +        goto fail;
> +    }
> Tests hang on 64-bit build when trying to apply -1 length. I didn't look deeper, but I suspect you're depending on allocation failure to handle that case.

-- 
https://gitlab.winehq.org/wine/wine/-/merge_requests/8781#note_113152