From 8620d15d3960921a8f316e0653ef0d11ceb55e89 Mon Sep 17 00:00:00 2001
From: Rob Shearman <rob@codeweavers.com>
Date: Wed, 14 Mar 2007 15:46:16 +0000
Subject: [PATCH] rpcrt4: Unmarshal NULL OLE interfaces properly by handling
 the case of a 0 stream size.

---
 dlls/rpcrt4/ndr_ole.c | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/dlls/rpcrt4/ndr_ole.c b/dlls/rpcrt4/ndr_ole.c
index 6c321217ee5..b65e18b0a1b 100644
--- a/dlls/rpcrt4/ndr_ole.c
+++ b/dlls/rpcrt4/ndr_ole.c
@@ -288,12 +288,14 @@ unsigned char * WINAPI NdrInterfacePointerUnmarshall(PMIDL_STUB_MESSAGE pStubMsg
   *(LPVOID*)ppMemory = NULL;
   if (pStubMsg->Buffer + sizeof(DWORD) < (unsigned char *)pStubMsg->RpcMsg->Buffer + pStubMsg->BufferLength) {
     stream = RpcStream_Create(pStubMsg, FALSE);
-    if (stream) {
+    if (!stream) RpcRaiseException(E_OUTOFMEMORY);
+    if (*((RpcStreamImpl *)stream)->size != 0)
       hr = COM_UnmarshalInterface(stream, &IID_NULL, (LPVOID*)ppMemory);
-      IStream_Release(stream);
-      if (FAILED(hr))
+    else
+      hr = S_OK;
+    IStream_Release(stream);
+    if (FAILED(hr))
         RpcRaiseException(hr);
-    }
   }
   return NULL;
 }