Piotr Caban : oleaut32: Don' t overwrite pointers in VARIANT_UserUnmarshal so we may free or reuse them.

[Alexandre Julliard]

Module: wine
Branch: master
Commit: ba498e6002728df149730f7089c0c81e661639d0
URL:    http://source.winehq.org/git/wine.git/?a=commit;h=ba498e6002728df149730f7089c0c81e661639d0

Author: Piotr Caban <piotr at codeweavers.com>
Date:   Wed Jan 13 09:51:44 2016 +0100

oleaut32: Don't overwrite pointers in VARIANT_UserUnmarshal so we may free or reuse them.

Signed-off-by: Piotr Caban <piotr at codeweavers.com>
Signed-off-by: Alexandre Julliard <julliard at winehq.org>

---

 dlls/oleaut32/usrmarshal.c | 22 +++++++++++++++-------
 1 file changed, 15 insertions(+), 7 deletions(-)

diff --git a/dlls/oleaut32/usrmarshal.c b/dlls/oleaut32/usrmarshal.c
index 726dd96..955b709 100644
--- a/dlls/oleaut32/usrmarshal.c
+++ b/dlls/oleaut32/usrmarshal.c
@@ -349,10 +349,6 @@ static unsigned char *interface_variant_unmarshal(ULONG *pFlags, unsigned char *
   ptr = *(DWORD*)Buffer;
   Buffer += sizeof(DWORD);
 
-  /* Clear any existing interface which WdtpInterfacePointer_UserUnmarshal()
-     would try to release.  This has been done already with a VariantClear(). */
-  *ppunk = NULL;
-
   if(!ptr)
       return Buffer;
 
@@ -528,8 +524,14 @@ unsigned char * WINAPI VARIANT_UserUnmarshal(ULONG *pFlags, unsigned char *Buffe
             memset(V_BYREF(pvar), 0, mem_size);
         }
 
-        if(!(header->vt & VT_ARRAY))
+        if(!(header->vt & VT_ARRAY)
+                && (header->vt & VT_TYPEMASK) != VT_BSTR
+                && (header->vt & VT_TYPEMASK) != VT_VARIANT
+                && (header->vt & VT_TYPEMASK) != VT_UNKNOWN
+                && (header->vt & VT_TYPEMASK) != VT_DISPATCH
+                && (header->vt & VT_TYPEMASK) != VT_RECORD)
             memcpy(V_BYREF(pvar), Pos, type_size);
+
         if((header->vt & VT_TYPEMASK) != VT_VARIANT)
             Pos += type_size;
         else
@@ -540,6 +542,14 @@ unsigned char * WINAPI VARIANT_UserUnmarshal(ULONG *pFlags, unsigned char *Buffe
         VariantClear(pvar);
         if(header->vt & VT_ARRAY)
             V_ARRAY(pvar) = NULL;
+        else if((header->vt & VT_TYPEMASK) == VT_BSTR)
+            V_BSTR(pvar) = NULL;
+        else if((header->vt & VT_TYPEMASK) == VT_UNKNOWN)
+            V_UNKNOWN(pvar) = NULL;
+        else if((header->vt & VT_TYPEMASK) == VT_DISPATCH)
+            V_DISPATCH(pvar) = NULL;
+        else if((header->vt & VT_TYPEMASK) == VT_RECORD)
+            V_RECORD(pvar) = NULL;
         else if((header->vt & VT_TYPEMASK) == VT_DECIMAL)
             memcpy(pvar, Pos, type_size);
         else
@@ -564,11 +574,9 @@ unsigned char * WINAPI VARIANT_UserUnmarshal(ULONG *pFlags, unsigned char *Buffe
         switch (header->vt)
         {
         case VT_BSTR:
-            V_BSTR(pvar) = NULL;
             Pos = BSTR_UserUnmarshal(pFlags, Pos, &V_BSTR(pvar));
             break;
         case VT_BSTR | VT_BYREF:
-            *V_BSTRREF(pvar) = NULL;
             Pos = BSTR_UserUnmarshal(pFlags, Pos, V_BSTRREF(pvar));
             break;
         case VT_VARIANT | VT_BYREF: