Rob Shearman : oleaut32: Fix accessing beyond end of buffer and memory leak in test_DispCallFunc.

[Alexandre Julliard]

Module: wine
Branch: master
Commit: a94265e5a990bbffa7dbfc42bc0cd2d2392995b1
URL:    http://source.winehq.org/git/wine.git/?a=commit;h=a94265e5a990bbffa7dbfc42bc...

Author: Rob Shearman 
Date:   Sun Nov 29 10:21:35 2009 +0000

oleaut32: Fix accessing beyond end of buffer and memory leak in test_DispCallFunc.

The parameter isn't automatically converted by DispCallFunc, so make
sure we pass in the correct size of memory for the function to store
its BSTR in.

---

dlls/oleaut32/tests/tmarshal.c |    5 +++--
 1 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/dlls/oleaut32/tests/tmarshal.c b/dlls/oleaut32/tests/tmarshal.c
index 46f1cdc..ae4f2aa 100644
--- a/dlls/oleaut32/tests/tmarshal.c
+++ b/dlls/oleaut32/tests/tmarshal.c
@@ -1388,7 +1388,7 @@ static void test_DispCallFunc(void)
     V_VT(&vararg[0]) = VT_R8;
     V_R8(&vararg[0]) = 3.141;
     V_VT(&vararg[1]) = VT_BSTR;
-    V_BSTR(&vararg[1]) = SysAllocString(szEmpty);
+    V_BSTRREF(&vararg[1]) = CoTaskMemAlloc(sizeof(BSTR));
     V_VT(&vararg[2]) = VT_BSTR;
     V_BSTR(&vararg[2]) = SysAllocString(szEmpty);
     V_VT(&vararg[3]) = VT_VARIANT|VT_BYREF;
@@ -1399,7 +1399,8 @@ static void test_DispCallFunc(void)
     hr = DispCallFunc(pWidget, 9*sizeof(void*), CC_STDCALL, VT_UI4, 4, rgvt, rgpvarg, &varresult);
     ok_ole_success(hr, DispCallFunc);
     VariantClear(&varresult);
-    VariantClear(&vararg[1]);
+    SysFreeString(*V_BSTRREF(&vararg[1]));
+    CoTaskMemFree(V_BSTRREF(&vararg[1]));
     VariantClear(&vararg[2]);
     IWidget_Release(pWidget);
 }