OLE: Fix SafeArrayCopy for NULL pvData.

dlls/oleaut32/safearray.c

@@ -355,7 +355,9 @@ static HRESULT SAFEARRAY_DestroyData(SAFEARRAY *psa, ULONG ulStartCell)
 /* Copy data items from one array to another */
 static HRESULT SAFEARRAY_CopyData(SAFEARRAY *psa, SAFEARRAY *dest)
 {
-  if (!psa->pvData || !dest->pvData || psa->fFeatures & FADF_DATADELETED)
+  if (!psa->pvData)
+    return S_OK;
+  else if (!dest->pvData || psa->fFeatures & FADF_DATADELETED)
     return E_INVALIDARG;
   else
   {
@@ -1378,6 +1380,12 @@ HRESULT WINAPI SafeArrayCopy(SAFEARRAY *psa, SAFEARRAY **ppsaOut)
   if (!psa)
     return S_OK; /* Handles copying of NULL arrays */
 
+  if (!psa->cbElements)
+  {
+    ERR("not copying an array of 0 elements\n");
+    return E_INVALIDARG;
+  }
+
   if (psa->fFeatures & (FADF_RECORD|FADF_HAVEIID|FADF_HAVEVARTYPE))
   {
     VARTYPE vt;

dlls/oleaut32/tests/safearray.c

@@ -1418,7 +1418,7 @@ static void test_SafeArrayClear(void)
 static void test_SafeArrayCopy(void)
 {
   SAFEARRAYBOUND sab;
-  SAFEARRAY *sa;
+  SAFEARRAY *sa, *sa2;
   VARIANTARG vSrc, vDst;
   HRESULT hres;
 
@@ -1450,6 +1450,19 @@ static void test_SafeArrayCopy(void)
 
   SafeArrayDestroy(V_ARRAY(&vSrc));
   SafeArrayDestroy(V_ARRAY(&vDst));
+
+  hres = SafeArrayAllocDescriptor(1, &sa);
+  ok(hres == S_OK, "SafeArrayAllocDescriptor failed with error 0x%08lx\n", hres);
+
+  hres = SafeArrayCopy(sa, &sa2);
+  ok(hres == E_INVALIDARG,
+    "SafeArrayCopy with empty array should have failed with error E_INVALIDARG instead of 0x%08lx\n",
+    hres);
+  sa->cbElements = 16;
+  hres = SafeArrayCopy(sa, &sa2);
+  ok(hres == S_OK, "SafeArrayCopy failed with error 0x%08lx\n", hres);
+
+  SafeArrayDestroy(sa);
 }
 
 #define MKARRAY(low,num,typ) sab.lLbound = low; sab.cElements = num; \