Re: [PATCH 3/6] ole32, propsys: Rework PROPVARIANT (de)serialization

[Vincent Povirk]

> > I remember being concerned that StgConvertPropertyToVariant does not
> > accept a size for the serialized value. This is not good when we don't
> > trust the data we're reading.
> >
> > So, at least for deserialization I don't think we should use the public
> > API.
>
> Yes, I agree, it would be nice to have buffer length. Maybe the idea is to
> check some kind of a header first, could be that first DWORD is actually
> stream length, if that's the case it's not that bad.

Sadly, no, the size and how/if it's encoded depends on the type, which
is the first thing in the structure.