Skip to content

W
wine-winehq
Commit 37f1d4cb authored by Ulrich Czekalla's avatar Ulrich Czekalla Committed by Alexandre Julliard
Browse files
Options

oleaut32: Prevent freeing of random memory.

Don't assign type to variant until we're sure we are assigning a value.
parent fc2ce677
Hide whitespace changes
Inline Side-by-side
Showing with 4 additions and 2 deletions
dlls/oleaut32/variant.c
View file @ 37f1d4cb
...@@ -2952,7 +2952,6 @@ HRESULT WINAPI VarAdd(LPVARIANT left, LPVARIANT right, LPVARIANT result) ...@@ -2952,7 +2952,6 @@ HRESULT WINAPI VarAdd(LPVARIANT left, LPVARIANT right, LPVARIANT result)
/* Do the math */ /* Do the math */
hres = S_OK; hres = S_OK;
V_VT(&tv) = tvt;
V_VT(result) = resvt; V_VT(result) = resvt;
switch (tvt) { switch (tvt) {
case VT_DECIMAL: case VT_DECIMAL:
...@@ -2973,10 +2972,13 @@ HRESULT WINAPI VarAdd(LPVARIANT left, LPVARIANT right, LPVARIANT result) ...@@ -2973,10 +2972,13 @@ HRESULT WINAPI VarAdd(LPVARIANT left, LPVARIANT right, LPVARIANT result)
V_VT(result) = VT_R8; V_VT(result) = VT_R8;
V_R8(result) = r8res; V_R8(result) = r8res;
goto end; goto end;
} else } else {
V_VT(&tv) = tvt;
V_I8(&tv) = V_I8(&lv) + V_I8(&rv); V_I8(&tv) = V_I8(&lv) + V_I8(&rv);
}
break; break;
case VT_R8: case VT_R8:
V_VT(&tv) = tvt;
/* FIXME: overflow detection */ /* FIXME: overflow detection */
V_R8(&tv) = V_R8(&lv) + V_R8(&rv); V_R8(&tv) = V_R8(&lv) + V_R8(&rv);
break; break;
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment