From 37f1d4cb54d568bdb3bdc5a00752e62419628d67 Mon Sep 17 00:00:00 2001
From: Ulrich Czekalla <ulrich@codeweavers.com>
Date: Thu, 2 Feb 2006 13:18:43 +0100
Subject: [PATCH] oleaut32: Prevent freeing of random memory. Don't assign type
 to variant until we're sure we are assigning a value.

---
 dlls/oleaut32/variant.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/dlls/oleaut32/variant.c b/dlls/oleaut32/variant.c
index 4a2dd90dbe2..a40f3d0a191 100644
--- a/dlls/oleaut32/variant.c
+++ b/dlls/oleaut32/variant.c
@@ -2952,7 +2952,6 @@ HRESULT WINAPI VarAdd(LPVARIANT left, LPVARIANT right, LPVARIANT result)
 
     /* Do the math */
     hres = S_OK;
-    V_VT(&tv) = tvt;
     V_VT(result) = resvt;
     switch (tvt) {
         case VT_DECIMAL:
@@ -2973,10 +2972,13 @@ HRESULT WINAPI VarAdd(LPVARIANT left, LPVARIANT right, LPVARIANT result)
                 V_VT(result) = VT_R8;
                 V_R8(result) = r8res;
                 goto end;
-            } else
+            } else {
+                V_VT(&tv) = tvt;
                 V_I8(&tv) = V_I8(&lv) + V_I8(&rv);
+            }
             break;
         case VT_R8:
+            V_VT(&tv) = tvt;
             /* FIXME: overflow detection */
             V_R8(&tv) = V_R8(&lv) + V_R8(&rv);
             break;