[Bug 54457] New: vbscript memory leaks in interp_redim_preserve

[WineHQ Bugzilla]

https://bugs.winehq.org/show_bug.cgi?id=54457

Bug ID: 54457
           Summary: vbscript memory leaks in interp_redim_preserve
           Product: Wine
           Version: 7.21
          Hardware: x86-64
                OS: Linux
            Status: UNCONFIRMED
          Severity: normal
          Priority: P2
         Component: vbscript
          Assignee: [e-mail]
          Reporter: [e-mail]
      Distribution: ---

While porting Visual Pinball to cross platform, I started using XCode
Instruments to find some outstanding memory leaks.

Given the following code:

Dim X()
   Redim preserve X(20)
   Redim preserve X(30) 
   X(20) = 5
   Redim preserve X(40)

I noticed a few memory leaks which were not happening with interp_redim.

1) In `interp_redim`, after SafeArrayCreate, there is a free(bounds);

In `interp_redim_preserve`, there is no free(bounds); after SafeArrayCreate
when array == NULL || array->cDims = 0

2) The bounds is not free after `SafeArrayRedim`

Reworking the function as follows fixes the memory leaks:

static HRESULT interp_redim_preserve(exec_ctx_t *ctx)
{
    BSTR identifier = ctx->instr->arg1.bstr;
    const unsigned dim_cnt = ctx->instr->arg2.uint;
    VARIANT *v;
    unsigned i;
    SAFEARRAYBOUND *bounds;
    SAFEARRAY *array;
    ref_t ref;
    HRESULT hres;

TRACE("%s %u\n", debugstr_w(identifier), dim_cnt);

hres = lookup_identifier(ctx, identifier, VBDISP_LET, &ref);
    if(FAILED(hres)) {
        FIXME("lookup %s failed: %08lx\n", debugstr_w(identifier), hres);
        return hres;
    }

if(ref.type != REF_VAR) {
        FIXME("got ref.type = %d\n", ref.type);
        return E_FAIL;
    }

v = ref.u.v;

if(V_VT(v) == (VT_VARIANT|VT_BYREF)) {
        v = V_VARIANTREF(v);
    }

if(!(V_VT(v) & VT_ARRAY)) {
        FIXME("ReDim Preserve not valid on type %d\n", V_VT(v));
        return E_FAIL;
    }

hres = array_bounds_from_stack(ctx, dim_cnt, &bounds);
    if(FAILED(hres))
        return hres;

array = V_ARRAY(v);

if(array == NULL || array->cDims == 0) {
        /* can initially allocate the array */
        array = SafeArrayCreate(VT_VARIANT, dim_cnt, bounds);
        free(bounds);
        if(!array)
            return E_OUTOFMEMORY;

VariantClear(v);
        V_VT(v) = VT_ARRAY|VT_VARIANT;
        V_ARRAY(v) = array;

return S_OK;
    } else if(array->cDims != dim_cnt) {
        /* can't otherwise change the number of dimensions */
        TRACE("Can't resize %s, cDims %d != %d\n", debugstr_w(identifier),
array->cDims, dim_cnt);
        return MAKE_VBSERROR(VBSE_OUT_OF_BOUNDS);
    } else {
        /* can resize the last dimensions (if others match */
        for(i = 0; i+1 < dim_cnt; ++i) {
            if(array->rgsabound[array->cDims - 1 - i].cElements !=
bounds[i].cElements) {
                TRACE("Can't resize %s, bound[%d] %ld != %ld\n",
debugstr_w(identifier), i, array->rgsabound[i].cElements, bounds[i].cElements);
                return MAKE_VBSERROR(VBSE_OUT_OF_BOUNDS);
            }
        }

hres = SafeArrayRedim(array, &bounds[dim_cnt-1]);
        free(bounds);
        return hres;
    }
}