Changelog:
	Fix handling of VARIANT with VT_BYREF and null pointer in VariantChangeTypeEx.

Index: dlls/oleaut32/variant.c
===================================================================
RCS file: /home/wine/wine/dlls/oleaut32/variant.c,v
retrieving revision 1.100
diff -u -r1.100 variant.c
--- dlls/oleaut32/variant.c	22 Aug 2004 21:38:46 -0000	1.100
+++ dlls/oleaut32/variant.c	24 Aug 2004 13:55:09 -0000
@@ -984,8 +984,13 @@
       {
         VARIANTARG vTmp;
 
-        V_VT(&vTmp) = VT_EMPTY;
-        res = VariantCopyInd(&vTmp, pvargSrc);
+        if(V_VT(pvargSrc)&VT_BYREF && !V_BYREF(pvargSrc))
+          res = DISP_E_TYPEMISMATCH;
+        else
+        {
+          V_VT(&vTmp) = VT_EMPTY;
+          res = VariantCopyInd(&vTmp, pvargSrc);
+        }
 
         if (SUCCEEDED(res))
         {
Index: dlls/oleaut32/tests/vartype.c
===================================================================
RCS file: /home/wine/wine/dlls/oleaut32/tests/vartype.c,v
retrieving revision 1.15
diff -u -r1.15 vartype.c
--- dlls/oleaut32/tests/vartype.c	23 Aug 2004 19:39:50 -0000	1.15
+++ dlls/oleaut32/tests/vartype.c	24 Aug 2004 13:55:18 -0000
@@ -5249,7 +5249,35 @@
   ok(!ci.cCustData && !ci.prgCustData, "ClearCustData didn't clear fields!\n");
 }
 
+static void test_NullByRef()
+{
+  VARIANT v1, v2;
+  HRESULT hRes;
 
+  VariantClear(&v1);
+  VariantClear(&v2);
+  V_VT(&v1) = VT_BYREF|VT_VARIANT;
+  V_BYREF(&v1) = 0;
+
+  hRes = VariantChangeTypeEx(&v2, &v1, 0, 0, VT_I4);
+  ok(hRes == DISP_E_TYPEMISMATCH, "VariantChangeTypeEx should return DISP_E_TYPEMISMATCH\n");
+
+  VariantClear(&v1);
+  V_VT(&v1) = VT_BYREF|VT_VARIANT;
+  V_BYREF(&v1) = 0;
+  V_VT(&v2) = VT_I4;
+  V_I4(&v2) = 123;
+
+  hRes = VariantChangeTypeEx(&v2, &v1, 0, 0, VT_VARIANT);
+  ok(hRes == DISP_E_TYPEMISMATCH, "VariantChangeTypeEx should return DISP_E_TYPEMISMATCH\n");
+  ok(V_VT(&v2) == VT_I4 && V_I4(&v2) == 123, "VariantChangeTypeEx shouldn't change pvargDest\n");
+
+  hRes = VariantChangeTypeEx(&v2, &v1, 0, 0, VT_BYREF|VT_I4);
+  ok(hRes == DISP_E_TYPEMISMATCH, "VariantChangeTypeEx should return DISP_E_TYPEMISMATCH\n");
+
+  hRes = VariantChangeTypeEx(&v2, &v1, 0, 0, 0x3847);
+  ok(hRes == DISP_E_BADVARTYPE, "VariantChangeTypeEx should return DISP_E_BADVARTYPE\n");
+}
 
 START_TEST(vartype)
 {
@@ -5539,4 +5567,6 @@
   test_UintChangeTypeEx();
 
   test_ClearCustData();
+
+  test_NullByRef();
 }