The COM IEnumXxx/IEnumUnknown::Next API allows callers to pass NULL for
pceltFetched when celt is 1. Guard the write to prevent crashing.

Fixes: b39297aedfab ("qemu-ga: Add Windows VSS provider and requester as DLL")
Signed-off-by: Marc-André Lureau <[email protected]>
---
 qga/vss-win32/provider.cpp | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/qga/vss-win32/provider.cpp b/qga/vss-win32/provider.cpp
index 79906dcc24ae..377571b94881 100644
--- a/qga/vss-win32/provider.cpp
+++ b/qga/vss-win32/provider.cpp
@@ -117,7 +117,9 @@ STDMETHODIMP_(ULONG) CQGAVSSEnumObject::Release()
 STDMETHODIMP CQGAVSSEnumObject::Next(
     ULONG celt, VSS_OBJECT_PROP *rgelt, ULONG *pceltFetched)
 {
-    *pceltFetched = 0;
+    if (pceltFetched) {
+        *pceltFetched = 0;
+    }
     return S_FALSE;
 }
 

-- 
2.55.0.543.g5ebe2ebe4ea8


Reply via email to