widl problem in argument ordering

[Marcus Meissner]

Hi,

Coverity issue "CID 1299032 Explicit null dereferenced"
shows I think a problem of the widl generated stub marshaller.

The IDL is:
interface IAccIdentity : IUnknown
{
    HRESULT GetIdentityString([in] DWORD idchild,
                              [out, size_is(*string_len)] BYTE **str,
                              [out] DWORD *string_len);
}

the generated stub is:

void __RPC_STUB IAccIdentity_GetIdentityString_Stub(
        IRpcStubBuffer* This,
        IRpcChannelBuffer *_pRpcChannelBuffer,
        PRPC_MESSAGE _pRpcMessage,
        DWORD* _pdwStubPhase)
    {   
        struct __frame_IAccIdentity_GetIdentityString_Stub __f, * const __frame = &__f;

__frame->_This = (IAccIdentity*)((CStdStubBuffer*)This)->pvServerObject;

NdrStubInitialize(_pRpcMessage, &__frame->_StubMsg, &Object_StubDesc, _pRpcChannelBuffer);

RpcExceptionInit( 0, __finally_IAccIdentity_GetIdentityString_Stub );
        __frame->str = 0;
        __frame->string_len = 0;

RpcTryFinally
        {   
    	if ((_pRpcMessage->DataRepresentation & 0xffff) != NDR_LOCAL_DATA_REPRESENTATION)
    	    NdrConvert( &__frame->_StubMsg, &__MIDL_ProcFormatString.Format[216]);

__frame->_StubMsg.Buffer = (unsigned char *)(((ULONG_PTR)__frame->_StubMsg.Buffer + 3) & ~0x3);
    	if (__frame->_StubMsg.Buffer + sizeof(DWORD) > __frame->_StubMsg.BufferEnd)
    	{   
    	    RpcRaiseException(RPC_X_BAD_STUB_DATA);
    	}
    	__frame->idchild = *(DWORD *)__frame->_StubMsg.Buffer;
    	__frame->_StubMsg.Buffer += sizeof(DWORD);

__frame->str = NdrAllocate(&__frame->_StubMsg, *__frame->string_len * 4); // DEREFERENCED
    	memset(__frame->str, 0, *__frame->string_len * 4);
    	__frame->string_len = &__frame->_W0; 					// ACTUALLY initialized
    	__frame->_W0 = 0;

Not that __frame->string_len is dereferenced before it is set to &__frame->_W0.

There seems to be a bit of an ordering problem here?

Ciao, Marcus