widl problem in argument ordering

[Marcus Meissner]

Hi,

Coverity issue "CID 1299032 Explicit null dereferenced"
shows I think a problem of the widl generated stub marshaller.

The IDL is:
interface IAccIdentity : IUnknown
{
    HRESULT GetIdentityString([in] DWORD idchild,
                              [out, size_is(*string_len)] BYTE **str,
                              [out] DWORD *string_len);
}

the generated stub is:

	void __RPC_STUB IAccIdentity_GetIdentityString_Stub(
	    IRpcStubBuffer* This,
	    IRpcChannelBuffer *_pRpcChannelBuffer,
	    PRPC_MESSAGE _pRpcMessage,
	    DWORD* _pdwStubPhase)
	{   
	    struct __frame_IAccIdentity_GetIdentityString_Stub __f, * const __frame = &__f;

	    __frame->_This = (IAccIdentity*)((CStdStubBuffer*)This)->pvServerObject;

	    NdrStubInitialize(_pRpcMessage, &__frame->_StubMsg, &Object_StubDesc, _pRpcChannelBuffer);

	    RpcExceptionInit( 0, __finally_IAccIdentity_GetIdentityString_Stub );
	    __frame->str = 0;
	    __frame->string_len = 0;

	    RpcTryFinally
	    {   
		if ((_pRpcMessage->DataRepresentation & 0xffff) != NDR_LOCAL_DATA_REPRESENTATION)
		    NdrConvert( &__frame->_StubMsg, &__MIDL_ProcFormatString.Format[216]);

		__frame->_StubMsg.Buffer = (unsigned char *)(((ULONG_PTR)__frame->_StubMsg.Buffer + 3) & ~0x3);
		if (__frame->_StubMsg.Buffer + sizeof(DWORD) > __frame->_StubMsg.BufferEnd)
		{   
		    RpcRaiseException(RPC_X_BAD_STUB_DATA);
		}
		__frame->idchild = *(DWORD *)__frame->_StubMsg.Buffer;
		__frame->_StubMsg.Buffer += sizeof(DWORD);


		__frame->str = NdrAllocate(&__frame->_StubMsg, *__frame->string_len * 4); // DEREFERENCED
		memset(__frame->str, 0, *__frame->string_len * 4);
		__frame->string_len = &__frame->_W0; 					// ACTUALLY initialized
		__frame->_W0 = 0;


Not that __frame->string_len is dereferenced before it is set to &__frame->_W0.

There seems to be a bit of an ordering problem here?

Ciao, Marcus