[PATCH v2 0/2] MR2268: oleaut32: Allocate a full pointer when unmarshalling byref arrays.

[Rémi Bernon (＠rbernon)]

Instead of the 4 bytes array wire size returned by get_type_size,
which will truncate the pointer on 64-bit.

Wine-Bug: https://bugs.winehq.org/show_bug.cgi?id=54562

--
  v2: oleaut32: Allocate a full pointer when unmarshalling byref arrays.
      oleaut32/tests: Test VARIANT_UserUnmarshal allocation sizes.

https://gitlab.winehq.org/wine/wine/-/merge_requests/2268

[PATCH v2 1/2] oleaut32/tests: Test VARIANT_UserUnmarshal allocation sizes.

[Rémi Bernon]

From: Rémi Bernon

---
 dlls/oleaut32/tests/usrmarshal.c | 29 +++++++++++++++++++++++++----
 1 file changed, 25 insertions(+), 4 deletions(-)

diff --git a/dlls/oleaut32/tests/usrmarshal.c b/dlls/oleaut32/tests/usrmarshal.c
index c4f4381b47f..d4ffdbde82f 100644
--- a/dlls/oleaut32/tests/usrmarshal.c
+++ b/dlls/oleaut32/tests/usrmarshal.c
@@ -898,7 +898,9 @@ static void test_marshal_VARIANT(void)
     RPC_MESSAGE rpcMsg = { 0 };
     USER_MARSHAL_CB umcb = { 0 };
     unsigned char *buffer, *next;
+    IMalloc *allocator;
     void *oldbuffer;
+    SIZE_T size;
     ULONG ul;
     short s;
     double d;
@@ -916,6 +918,10 @@ static void test_marshal_VARIANT(void)
     VARTYPE vt, vt2;
     IUnknown *unk;

+    hr = CoGetMalloc(MEMCTX_TASK, &allocator);
+    ok(hr == S_OK, "got hr %#lx\n", hr);
+    ok(!!allocator, "got allocator %p\n", allocator);
+
     stubMsg.RpcMsg = &rpcMsg;

umcb.Flags = MAKELONG(MSHCTX_DIFFERENTMACHINE, NDR_LOCAL_DATA_REPRESENTATION);
@@ -1098,7 +1104,8 @@ static void test_marshal_VARIANT(void)
     ok(next == buffer + stubMsg.BufferLength, "got %p expect %p\n", next, buffer + stubMsg.BufferLength);
     ok(V_VT(&v) == V_VT(&v2), "got vt %d expect %d\n", V_VT(&v), V_VT(&v2));
     ok(*V_UI4REF(&v) == *V_UI4REF(&v2), "got ui4 ref %lx expect ui4 ref %lx\n", *V_UI4REF(&v), *V_UI4REF(&v2));
-
+    size = IMalloc_GetSize(allocator, V_BYREF(&v2));
+    ok(size == sizeof(V_UI4(&v2)), "got size %#Ix\n", size);
     VARIANT_UserFree(&umcb.Flags, &v2);
     HeapFree(GetProcessHeap(), 0, oldbuffer);

@@ -1212,7 +1219,8 @@ static void test_marshal_VARIANT(void)
     ok(next == buffer + stubMsg.BufferLength, "got %p expect %p\n", next, buffer + stubMsg.BufferLength);
     ok(V_VT(&v) == V_VT(&v2), "got vt %d expect %d\n", V_VT(&v), V_VT(&v2));
     ok(*V_R8REF(&v) == *V_R8REF(&v2), "got r8 ref %f expect %f\n", *V_R8REF(&v), *V_R8REF(&v2));
-
+    size = IMalloc_GetSize(allocator, V_BYREF(&v2));
+    ok(size == sizeof(V_R8(&v2)), "got size %#Ix\n", size);
     VARIANT_UserFree(&umcb.Flags, &v2);
     HeapFree(GetProcessHeap(), 0, oldbuffer);

@@ -1307,7 +1315,8 @@ static void test_marshal_VARIANT(void)
     ok(next == buffer + stubMsg.BufferLength, "got %p expect %p\n", next, buffer + stubMsg.BufferLength);
     ok(V_VT(&v) == V_VT(&v2), "got vt %d expect %d\n", V_VT(&v), V_VT(&v2));
     ok(!memcmp(V_DECIMALREF(&v), V_DECIMALREF(&v2), sizeof(DECIMAL)), "decimals differ\n");
-
+    size = IMalloc_GetSize(allocator, V_BYREF(&v2));
+    ok(size == sizeof(V_DECIMAL(&v2)), "got size %#Ix\n", size);
     VARIANT_UserFree(&umcb.Flags, &v2);
     HeapFree(GetProcessHeap(), 0, oldbuffer);

@@ -1418,7 +1427,8 @@ static void test_marshal_VARIANT(void)
     ok(V_VT(&v) == V_VT(&v2), "got vt %d expect %d\n", V_VT(&v), V_VT(&v2));
     ok(SysStringByteLen(*V_BSTRREF(&v)) == SysStringByteLen(*V_BSTRREF(&v2)), "bstr string lens differ\n");
     ok(!memcmp(*V_BSTRREF(&v), *V_BSTRREF(&v2), SysStringByteLen(*V_BSTRREF(&v))), "bstrs differ\n");
-
+    size = IMalloc_GetSize(allocator, V_BYREF(&v2));
+    ok(size == sizeof(V_BSTR(&v2)), "got size %#Ix\n", size);
     SysFreeString(b2);
     HeapFree(GetProcessHeap(), 0, oldbuffer);
     SysFreeString(b);
@@ -1503,6 +1513,9 @@ static void test_marshal_VARIANT(void)
     SafeArrayGetVartype(*V_ARRAYREF(&v), &vt);
     SafeArrayGetVartype(*V_ARRAYREF(&v2), &vt2);
     ok(vt == vt2, "array vts differ %x %x\n", vt, vt2);
+    size = IMalloc_GetSize(allocator, V_BYREF(&v2));
+    todo_wine_if(sizeof(void *) == 8)
+    ok(size == sizeof(V_ARRAY(&v2)), "got size %#Ix\n", size);
     VARIANT_UserFree(&umcb.Flags, &v2);
     HeapFree(GetProcessHeap(), 0, oldbuffer);

@@ -1594,6 +1607,8 @@ static void test_marshal_VARIANT(void)
     ok(V_VT(V_VARIANTREF(&v)) == V_VT(V_VARIANTREF(&v3)), "vts differ %x %x\n",
        V_VT(V_VARIANTREF(&v)), V_VT(V_VARIANTREF(&v3))); 
     ok(V_R8(V_VARIANTREF(&v)) == V_R8(V_VARIANTREF(&v3)), "r8s differ\n"); 
+    size = IMalloc_GetSize(allocator, V_BYREF(&v3));
+    ok(size == sizeof(*V_VARIANTREF(&v3)), "got size %#Ix\n", size);
     VARIANT_UserFree(&umcb.Flags, &v3);
     HeapFree(GetProcessHeap(), 0, oldbuffer);

@@ -1704,6 +1719,8 @@ static void test_marshal_VARIANT(void)
     ok(heap_unknown->refs == 2, "got refcount %ld\n", heap_unknown->refs);
     ok(V_VT(&v) == V_VT(&v3), "got vt %d expect %d\n", V_VT(&v), V_VT(&v3));
     ok(*V_UNKNOWNREF(&v) == *V_UNKNOWNREF(&v3), "got %p expect %p\n", *V_UNKNOWNREF(&v), *V_UNKNOWNREF(&v3));
+    size = IMalloc_GetSize(allocator, V_BYREF(&v3));
+    ok(size == sizeof(V_BSTR(&v3)), "got size %#Ix\n", size);
     VARIANT_UserFree(&umcb.Flags, &v3);
     ok(heap_unknown->refs == 1, "%ld refcounts of IUnknown leaked\n", heap_unknown->refs - 1);
     IUnknown_Release(&heap_unknown->IUnknown_iface);
@@ -1732,8 +1749,12 @@ static void test_marshal_VARIANT(void)
     ok(next == buffer + stubMsg.BufferLength, "got %p expect %p\n", next, buffer + stubMsg.BufferLength);
     ok(V_VT(&v) == V_VT(&v2), "got vt %d expect %d\n", V_VT(&v2), V_VT(&v));
     ok(!*V_UNKNOWNREF(&v2), "got %p expect NULL\n", *V_UNKNOWNREF(&v2));
+    size = IMalloc_GetSize(allocator, V_BYREF(&v2));
+    ok(size == sizeof(V_BSTR(&v2)), "got size %#Ix\n", size);
     VARIANT_UserFree(&umcb.Flags, &v2);
     HeapFree(GetProcessHeap(), 0, oldbuffer);
+
+    IMalloc_Release(allocator);
 }

[PATCH v2 2/2] oleaut32: Allocate a full pointer when unmarshalling byref arrays.

[Rémi Bernon]

From: Rémi Bernon

Instead of the 4 bytes array wire size returned by get_type_size,
which will truncate the pointer on 64-bit.

Wine-Bug: https://bugs.winehq.org/show_bug.cgi?id=54562
---
 dlls/oleaut32/tests/usrmarshal.c | 1 -
 dlls/oleaut32/usrmarshal.c       | 5 ++++-
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/dlls/oleaut32/tests/usrmarshal.c b/dlls/oleaut32/tests/usrmarshal.c
index d4ffdbde82f..6559cdcd865 100644
--- a/dlls/oleaut32/tests/usrmarshal.c
+++ b/dlls/oleaut32/tests/usrmarshal.c
@@ -1514,7 +1514,6 @@ static void test_marshal_VARIANT(void)
     SafeArrayGetVartype(*V_ARRAYREF(&v2), &vt2);
     ok(vt == vt2, "array vts differ %x %x\n", vt, vt2);
     size = IMalloc_GetSize(allocator, V_BYREF(&v2));
-    todo_wine_if(sizeof(void *) == 8)
     ok(size == sizeof(V_ARRAY(&v2)), "got size %#Ix\n", size);
     VARIANT_UserFree(&umcb.Flags, &v2);
     HeapFree(GetProcessHeap(), 0, oldbuffer);
diff --git a/dlls/oleaut32/usrmarshal.c b/dlls/oleaut32/usrmarshal.c
index aa54a2b092b..4a874a23413 100644
--- a/dlls/oleaut32/usrmarshal.c
+++ b/dlls/oleaut32/usrmarshal.c
@@ -506,7 +506,10 @@ unsigned char * WINAPI VARIANT_UserUnmarshal(ULONG *pFlags, unsigned char *Buffe
         ULONG mem_size;
         Pos += 4;

-        switch (header->vt & ~VT_BYREF)
+        /* byref array needs to allocate a SAFEARRAY pointer */
+        if (header->vt & VT_ARRAY)
+            mem_size = sizeof(void *);
+        else switch (header->vt & ~VT_BYREF)
         {
         /* these types have a different memory size compared to wire size */
         case VT_UNKNOWN:

[Rémi Bernon (＠rbernon)]

v2: Add tests, rebase before the regression to better show the fix.

[PATCH v2 0/2] MR2268: oleaut32: Allocate a full pointer when unmarshalling byref arrays. - approved

[Huw Davies (＠huw)]

This merge request was approved by Huw Davies.