From 3a2574e3cc93cac79fa272c0a72574aaf0bd7774 Mon Sep 17 00:00:00 2001
From: Jacek Caban <jack@itma.pwr.wroc.pl>
Date: Wed, 25 Aug 2004 00:38:59 +0000
Subject: [PATCH] Fix handling of VARIANT with VT_BYREF and null pointer in
 VariantChangeTypeEx.

---
 dlls/oleaut32/tests/vartype.c | 30 ++++++++++++++++++++++++++++++
 dlls/oleaut32/variant.c       |  9 +++++++--
 2 files changed, 37 insertions(+), 2 deletions(-)

diff --git a/dlls/oleaut32/tests/vartype.c b/dlls/oleaut32/tests/vartype.c
index e78b28da04e..9f9303d88d9 100644
--- a/dlls/oleaut32/tests/vartype.c
+++ b/dlls/oleaut32/tests/vartype.c
@@ -5249,7 +5249,35 @@ static void test_ClearCustData(void)
   ok(!ci.cCustData && !ci.prgCustData, "ClearCustData didn't clear fields!\n");
 }
 
+static void test_NullByRef()
+{
+  VARIANT v1, v2;
+  HRESULT hRes;
+
+  VariantClear(&v1);
+  VariantClear(&v2);
+  V_VT(&v1) = VT_BYREF|VT_VARIANT;
+  V_BYREF(&v1) = 0;
+
+  hRes = VariantChangeTypeEx(&v2, &v1, 0, 0, VT_I4);
+  ok(hRes == DISP_E_TYPEMISMATCH, "VariantChangeTypeEx should return DISP_E_TYPEMISMATCH\n");
+
+  VariantClear(&v1);
+  V_VT(&v1) = VT_BYREF|VT_VARIANT;
+  V_BYREF(&v1) = 0;
+  V_VT(&v2) = VT_I4;
+  V_I4(&v2) = 123;
 
+  hRes = VariantChangeTypeEx(&v2, &v1, 0, 0, VT_VARIANT);
+  ok(hRes == DISP_E_TYPEMISMATCH, "VariantChangeTypeEx should return DISP_E_TYPEMISMATCH\n");
+  ok(V_VT(&v2) == VT_I4 && V_I4(&v2) == 123, "VariantChangeTypeEx shouldn't change pvargDest\n");
+
+  hRes = VariantChangeTypeEx(&v2, &v1, 0, 0, VT_BYREF|VT_I4);
+  ok(hRes == DISP_E_TYPEMISMATCH, "VariantChangeTypeEx should return DISP_E_TYPEMISMATCH\n");
+
+  hRes = VariantChangeTypeEx(&v2, &v1, 0, 0, 0x3847);
+  ok(hRes == DISP_E_BADVARTYPE, "VariantChangeTypeEx should return DISP_E_BADVARTYPE\n");
+}
 
 START_TEST(vartype)
 {
@@ -5539,4 +5567,6 @@ START_TEST(vartype)
   test_UintChangeTypeEx();
 
   test_ClearCustData();
+
+  test_NullByRef();
 }
diff --git a/dlls/oleaut32/variant.c b/dlls/oleaut32/variant.c
index 3b785bfb173..61e8e763676 100644
--- a/dlls/oleaut32/variant.c
+++ b/dlls/oleaut32/variant.c
@@ -984,8 +984,13 @@ HRESULT WINAPI VariantChangeTypeEx(VARIANTARG* pvargDest, VARIANTARG* pvargSrc,
       {
         VARIANTARG vTmp;
 
-        V_VT(&vTmp) = VT_EMPTY;
-        res = VariantCopyInd(&vTmp, pvargSrc);
+        if(V_VT(pvargSrc)&VT_BYREF && !V_BYREF(pvargSrc))
+          res = DISP_E_TYPEMISMATCH;
+        else
+        {
+          V_VT(&vTmp) = VT_EMPTY;
+          res = VariantCopyInd(&vTmp, pvargSrc);
+        }
 
         if (SUCCEEDED(res))
         {
-- 
2.11.4.GIT