vlccontrol.cpp: fixed bounds issue when allocating memory and iterating through a...

[vlc] / activex / vlccontrol.cpp

diff --git a/activex/vlccontrol.cpp b/activex/vlccontrol.cpp
index 61d611aff7ab49f2aff15d182554d9cbef2f4998..cbd467946d61a3840e20d9490ce26b534c06050f 100644 (file)
--- a/activex/vlccontrol.cpp
+++ b/activex/vlccontrol.cpp
@@ -371,6 +371,7 @@ STDMETHODIMP VLCControl::setVariable(BSTR name, VARIANT value)
                     hr = VariantChangeType(&arg, &value, 0, VT_BSTR);
                     if( SUCCEEDED(hr) )
                     {
+                        i_type = VLC_VAR_STRING;
                         val.psz_string = CStrFromBSTR(codePage, V_BSTR(&arg));
                         VariantClear(&arg);
                     }
@@ -631,12 +632,12 @@ static HRESULT createTargetOptions(int codePage, VARIANT *options, char ***cOpti
             // marshall options into an array of C strings
             if( VT_VARIANT == vType )
             {
-                *cOptions = (char **)CoTaskMemAlloc(sizeof(char *)*(uBound-lBound));
+                *cOptions = (char **)CoTaskMemAlloc(sizeof(char *)*(uBound-lBound+1));
                 if( NULL == *cOptions )
                     return E_OUTOFMEMORY;
 
-                ZeroMemory(*cOptions, sizeof(char *)*(uBound-lBound));
-                for(pos=lBound; SUCCEEDED(hr) && (pos<=uBound); ++pos )
+                ZeroMemory(*cOptions, sizeof(char *)*(uBound-lBound+1));
+                for(pos=lBound; (pos<=uBound) && SUCCEEDED(hr); ++pos )
                 {
                     VARIANT option;
                     hr = SafeArrayGetElement(array, &pos, &option);
@@ -658,12 +659,12 @@ static HRESULT createTargetOptions(int codePage, VARIANT *options, char ***cOpti
             }
             else if( VT_BSTR == vType )
             {
-                *cOptions = (char **)CoTaskMemAlloc(sizeof(char *)*(uBound-lBound));
+                *cOptions = (char **)CoTaskMemAlloc(sizeof(char *)*(uBound-lBound+1));
                 if( NULL == *cOptions )
                     return E_OUTOFMEMORY;
 
-                ZeroMemory(*cOptions, sizeof(char *)*(uBound-lBound));
-                for(pos=lBound; (pos<uBound) && SUCCEEDED(hr); ++pos )
+                ZeroMemory(*cOptions, sizeof(char *)*(uBound-lBound+1));
+                for(pos=lBound; (pos<=uBound) && SUCCEEDED(hr); ++pos )
                 {
                     BSTR option;
                     hr = SafeArrayGetElement(array, &pos, &option);