Universal Gateway mishandles ByRef Variant arguments

[ghost]

Symptoms

PyWin32 is installed from pywin32-204.win32-py2.3.exe. Using win32com.server to add commands to Visual Studio .NET 2003, dispatch to IDTCommandTarget.QueryStatus fails, saying "Cant convert vectors!". Execution never reaches the Python COM server's implementation of the QueryStatus method.

Cause

in univgw_dataconv.cpp, in dataconv_ReadFromInTuple (), there is a bug in the handling of ByRef Variant arguments. Such an argument is not dereferenced before being passed to PyCom_PyObjectFromVariant(), so that the code attempts to construct a Python object from data that does not constitute a Variant.

In the worst case this could cause an access violation and the premature death of the host process.

Solution

Applying the following patch to univgw_dataconv.cpp solves the problem, allowing Python commands to be added to Visual Studio:

-------- diff -------- 711,713c711,720 < // A pointer to a _real_ variant. < VARIANT *pVar = (VARIANT *)pb; < obArg = PyCom_PyObjectFromVariant(pVar); --- > > // A _real_ variant. > if (bIsByRef) > { >
obArg = PyCom_PyObjectFromVariant(* (VARIANT**)pb); > } > else > { >
obArg = PyCom_PyObjectFromVariant ((VARIANT*)pb); > } -------- diff --------

I have tested the above diff using a debug build of pywin32 running on Python 2.4.1.

Remarks

The above diff brings the code for handling ByRef Variants into line with the nearby code for handling ByRef Int64s, and also with the corresponding code for handling ByRef Variants in dataconv_WriteFromOutTuple ().

Reported by: gbmvdd

Original Ticket: "pywin32/bugs/221":https://sourceforge.net/p/pywin32/bugs/221

[ghost]

• status: open --> closed-fixed

Original comment by: mhammond

[ghost]

Logged In: YES user_id=14198

checked into CVS - thanks.

Original comment by: mhammond