Reviewed-by: Kostiantyn Kostiuk <[email protected]>
On Mon, Sep 7, 2026 at 1:50 PM Marc-André Lureau <
[email protected]> wrote:
> The COM IEnumXxx/IEnumUnknown::Next API allows callers to pass NULL for
> pceltFetched when celt is 1. Guard the write to prevent crashing.
>
> Fixes: b39297aedfab ("qemu-ga: Add Windows VSS provider and requester as
> DLL")
> Signed-off-by: Marc-André Lureau <[email protected]>
> ---
> qga/vss-win32/provider.cpp | 4 +++-
> 1 file changed, 3 insertions(+), 1 deletion(-)
>
> diff --git a/qga/vss-win32/provider.cpp b/qga/vss-win32/provider.cpp
> index 79906dcc24ae..377571b94881 100644
> --- a/qga/vss-win32/provider.cpp
> +++ b/qga/vss-win32/provider.cpp
> @@ -117,7 +117,9 @@ STDMETHODIMP_(ULONG) CQGAVSSEnumObject::Release()
> STDMETHODIMP CQGAVSSEnumObject::Next(
> ULONG celt, VSS_OBJECT_PROP *rgelt, ULONG *pceltFetched)
> {
> - *pceltFetched = 0;
> + if (pceltFetched) {
> + *pceltFetched = 0;
> + }
> return S_FALSE;
> }
>
>
> --
> 2.55.0.543.g5ebe2ebe4ea8
>
>
