Esme Povirk (@madewokherd) commented about dlls/windowscodecs/metadataquery.c:
if (!(objects = calloc(count, sizeof(*objects))))
return E_OUTOFMEMORY;
if (SUCCEEDED(hr = IEnumUnknown_Next(enumerator->object_enumerator, count, objects, fetched)))
{
for (ULONG i = 0; i < *fetched; ++i)
{
index = 0;
hr = string_enumerator_update_guid_index(enumerator, &guid, &index, objects[i]);
if (FAILED(hr)) break;
if (!(str = CoTaskMemAlloc(64 * sizeof(WCHAR))))
{
hr = E_OUTOFMEMORY;
break;
}
I don't think the error path here quite works. If we exit the loop early, `*fetched` will be the number of IUnknown pointers we got from `object_enumerator`, but we won't return that many items in `strings`.