From f7b2add8d934c048826df94bc7ea322052ead1cb Mon Sep 17 00:00:00 2001
From: Nikolay Sivov <nsivov@codeweavers.com>
Date: Tue, 24 Aug 2010 22:36:38 +0400
Subject: [PATCH] oleaut32/olepicture: Remove out pointer check in
 OleCreatePictureIndirect, it should crash.

---
 dlls/oleaut32/olepicture.c       | 15 +++------------
 dlls/oleaut32/tests/olepicture.c | 10 +++++++++-
 2 files changed, 12 insertions(+), 13 deletions(-)

diff --git a/dlls/oleaut32/olepicture.c b/dlls/oleaut32/olepicture.c
index bd93ffa2eff..aaab2a163a9 100644
--- a/dlls/oleaut32/olepicture.c
+++ b/dlls/oleaut32/olepicture.c
@@ -2142,25 +2142,16 @@ static const IConnectionPointContainerVtbl OLEPictureImpl_IConnectionPointContai
  * OleCreatePictureIndirect (OLEAUT32.419)
  */
 HRESULT WINAPI OleCreatePictureIndirect(LPPICTDESC lpPictDesc, REFIID riid,
-		            BOOL fOwn, LPVOID *ppvObj )
+		            BOOL Own, void **ppvObj )
 {
   OLEPictureImpl* newPict;
   HRESULT hr;
 
-  TRACE("(%p,%s,%d,%p)\n", lpPictDesc, debugstr_guid(riid), fOwn, ppvObj);
-
-  /*
-   * Sanity check
-   */
-  if (ppvObj==0)
-    return E_POINTER;
+  TRACE("(%p,%s,%d,%p)\n", lpPictDesc, debugstr_guid(riid), Own, ppvObj);
 
   *ppvObj = NULL;
 
-  /*
-   * Try to construct a new instance of the class.
-   */
-  newPict = OLEPictureImpl_Construct(lpPictDesc, fOwn);
+  newPict = OLEPictureImpl_Construct(lpPictDesc, Own);
 
   if (newPict == NULL)
     return E_OUTOFMEMORY;
diff --git a/dlls/oleaut32/tests/olepicture.c b/dlls/oleaut32/tests/olepicture.c
index 9ab25150c66..03d47db5d1d 100644
--- a/dlls/oleaut32/tests/olepicture.c
+++ b/dlls/oleaut32/tests/olepicture.c
@@ -481,10 +481,10 @@ static void test_Invoke(void)
 
 static void test_OleCreatePictureIndirect(void)
 {
+    OLE_HANDLE handle;
     IPicture *pict;
     HRESULT hr;
     short type;
-    OLE_HANDLE handle;
 
     if(!pOleCreatePictureIndirect)
     {
@@ -492,13 +492,21 @@ static void test_OleCreatePictureIndirect(void)
         return;
     }
 
+if (0)
+{
+    /* crashes on native */
+    hr = pOleCreatePictureIndirect(NULL, &IID_IPicture, TRUE, NULL);
+}
+
     hr = pOleCreatePictureIndirect(NULL, &IID_IPicture, TRUE, (void**)&pict);
     ok(hr == S_OK, "hr %08x\n", hr);
 
+    type = PICTYPE_NONE;
     hr = IPicture_get_Type(pict, &type);
     ok(hr == S_OK, "hr %08x\n", hr);
     ok(type == PICTYPE_UNINITIALIZED, "type %d\n", type);
 
+    handle = 0xdeadbeef;
     hr = IPicture_get_Handle(pict, &handle);
     ok(hr == S_OK, "hr %08x\n", hr);
     ok(handle == 0, "handle %08x\n", handle);