Jacek Caban (@jacek) commented about dlls/vbscript/global.c:
+ + hres = SafeArrayAccessData(sa, (void**)&data); + if (FAILED(hres)) + goto cleanup; + + str_array = (BSTR *)malloc((ubound - lbound + 1) * sizeof(BSTR)); + if (!str_array) { + hres = E_OUTOFMEMORY; + goto cleanup_data; + } + + for (i = lbound; i <= ubound; i++) { + if (V_VT(&data[i]) != VT_BSTR) { + hres = to_string(&data[i], &str); + if (FAILED(hres)) + goto cleanup_data; In case of error, we'd leak previously converted strings, so cleanup code path should probably also iterate `str_array` and free them. We could move `SysFreeString` call to the cleanup part and have a separate loop there. With more code in the cleanup path, it would be tempting to share more with the success path: you could free everything first and then either return `hres` or `return_bstr` depending on `hres` variable.
-- https://gitlab.winehq.org/wine/wine/-/merge_requests/7052#note_93563