Nikolay Sivov (@nsivov) commented about dlls/uiautomationcore/uia_com_client.c:
- VariantInit(&v);
- hr = UiaGetPropertyValue(element->node, UIA_BoundingRectanglePropertyId, &v);
- if (SUCCEEDED(hr) && V_VT(&v) == (VT_R8 | VT_ARRAY))
- {
double vals[4];
LONG idx;
for (idx = 0; idx < ARRAY_SIZE(vals); idx++)
SafeArrayGetElement(V_ARRAY(&v), &idx, &vals[idx]);
ret_val->left = vals[0];
ret_val->top = vals[1];
ret_val->right = ret_val->left + vals[2];
ret_val->bottom = ret_val->top + vals[3];
VariantClear(&v);
- }
Similarly here, but also might be worth doing a bounds check. Can this data come from some custom source?