Re: [PATCH 3/6] ole32, propsys: Rework PROPVARIANT (de)serialization

[Nikolay Sivov]

On 16.07.2015 21:23, Vincent Povirk wrote:
> >    * The only interface to property (de)serialization provided by
> >      ole32.dll, the StgConvertVariantToProperty()/
> >      StgConvertPropertyToVariant() functions, are poorly documented,
> >      hard to implement (HRESULTs need to be converted to NTSTATUS
> >      exceptions) and even more unpleasant to use (because one would
> >      need to catch the NTSTATUS exception and convert it back to a
> >      HRESULT). This is rather crazy and cumbersome.
>
> I remember being concerned that StgConvertPropertyToVariant does not
> accept a size for the serialized value. This is not good when we don't
> trust the data we're reading.
>
> So, at least for deserialization I don't think we should use the public API.

Yes, I agree, it would be nice to have buffer length. Maybe the idea is 
to check some kind of a header first, could be that first DWORD is 
actually stream length, if that's the case it's not that bad.