ReceiveTempSMS
/
Sweden-Number
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

oleaut32/olepicture: Remove out pointer check in OleCreatePictureIndirect, it should crash.

This commit is contained in:
Nikolay Sivov 2010-08-24 22:36:38 +04:00 committed by Alexandre Julliard
parent b8f99cabb4
commit f7b2add8d9
2 changed files with 12 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
dlls/oleaut32/olepicture.c
View File

@ -2142,25 +2142,16 @@ static const IConnectionPointContainerVtbl OLEPictureImpl_IConnectionPointContai
* OleCreatePictureIndirect (OLEAUT32.419)
*/
HRESULT WINAPI OleCreatePictureIndirect(LPPICTDESC lpPictDesc, REFIID riid,
BOOL fOwn, LPVOID *ppvObj )
BOOL Own, void **ppvObj )
{
OLEPictureImpl* newPict;
HRESULT hr;
TRACE("(%p,%s,%d,%p)\n", lpPictDesc, debugstr_guid(riid), fOwn, ppvObj);
/*
* Sanity check
*/
if (ppvObj==0)
return E_POINTER;
TRACE("(%p,%s,%d,%p)\n", lpPictDesc, debugstr_guid(riid), Own, ppvObj);
*ppvObj = NULL;
/*
* Try to construct a new instance of the class.
*/
newPict = OLEPictureImpl_Construct(lpPictDesc, fOwn);
newPict = OLEPictureImpl_Construct(lpPictDesc, Own);
if (newPict == NULL)
return E_OUTOFMEMORY;

10
dlls/oleaut32/tests/olepicture.c
View File

@ -481,10 +481,10 @@ static void test_Invoke(void)
static void test_OleCreatePictureIndirect(void)
{
OLE_HANDLE handle;
IPicture *pict;
HRESULT hr;
short type;
OLE_HANDLE handle;
if(!pOleCreatePictureIndirect)
{
@ -492,13 +492,21 @@ static void test_OleCreatePictureIndirect(void)
return;
}
if (0)
{
/* crashes on native */
hr = pOleCreatePictureIndirect(NULL, &IID_IPicture, TRUE, NULL);
}
hr = pOleCreatePictureIndirect(NULL, &IID_IPicture, TRUE, (void**)&pict);
ok(hr == S_OK, "hr %08x\n", hr);
type = PICTYPE_NONE;
hr = IPicture_get_Type(pict, &type);
ok(hr == S_OK, "hr %08x\n", hr);
ok(type == PICTYPE_UNINITIALIZED, "type %d\n", type);
handle = 0xdeadbeef;
hr = IPicture_get_Handle(pict, &handle);
ok(hr == S_OK, "hr %08x\n", hr);
ok(handle == 0, "handle %08x\n", handle);