Menu

#467 OLEObject handling of DISP_E_EXCEPTION can crash interpreter

v4.0
closed
Classes (182)
5
2012-08-14
2007-11-22
No

When an OLE Automation object returns DISP_E_EXCEPTION from IDispatch::Invoke()there is an EXCEPINFO struction that the object is supposed to fill out with details on the error.

Reading the Microsoft docs leads one to believe that it is the OLE Automation object's responsibility to fill this in correctly when it returns DISP_E_EXCEPTION. However, it is apparent that some automation objects do not zero out the unused fields in the structure. In particular, the Microsoft Soap Client does not zero out the pfnDeferredFillIn field.

This causes the OLEObject to derefence, as a function call, random memory when the Soap Client returns DISP_E_EXCEPTION. Which ulitimately crashes the intepreter, but also produces some bizarre at times. <grin>

Discussion

  • Mark Miesfeld

    Mark Miesfeld - 2007-11-23

    Logged In: YES
    user_id=191588
    Originator: YES

    Committed revision 1288.

    This bug was originally reported on the RexxLA list by Garry Smithwick. He found it using the MS Soap SDK.

    It is always hard to find documentation on the finer points of OLE
    Automation. This excerpt from:

    http://www.ddj.com/windows/184404681

    says this about the EXCEPINFO structure:

    It's important to understand that the EXCEPINFO structure should be
    initialized to NULL (cleared out) when passed, and checked for any
    non-NULL members when ParseScriptText returns. Any BSTRs that
    appear in the structure must be released by calling SysFreeString().

     
  • Mark Miesfeld

    Mark Miesfeld - 2008-05-16

    Updated 3.2.0 OLEObject files

     
  • Mark Miesfeld

    Mark Miesfeld - 2008-05-16

    Logged In: YES
    user_id=191588
    Originator: YES

    File Added: oleObjectUpdate.zip

     
  • Mark Miesfeld

    Mark Miesfeld - 2010-02-19

    The fix for this item was in the 4.0.0 release.

     

Anonymous
Anonymous

Add attachments
Cancel