The COM IEnumXxx/IEnumUnknown::Next API allows callers to pass NULL for
pceltFetched when celt is 1. Guard the write to prevent crashing.
Fixes: b39297aedfab ("qemu-ga: Add Windows VSS provider and requester as DLL")
Signed-off-by: Marc-André Lureau <[email protected]>
---
qga/vss-win32/provider.cpp | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/qga/vss-win32/provider.cpp b/qga/vss-win32/provider.cpp
index 79906dcc24ae..377571b94881 100644
--- a/qga/vss-win32/provider.cpp
+++ b/qga/vss-win32/provider.cpp
@@ -117,7 +117,9 @@ STDMETHODIMP_(ULONG) CQGAVSSEnumObject::Release()
STDMETHODIMP CQGAVSSEnumObject::Next(
ULONG celt, VSS_OBJECT_PROP *rgelt, ULONG *pceltFetched)
{
- *pceltFetched = 0;
+ if (pceltFetched) {
+ *pceltFetched = 0;
+ }
return S_FALSE;
}
--
2.55.0.543.g5ebe2ebe4ea8