From: Yuxuan Shui yshui@codeweavers.com
For calls with return values, we emit a IsReturn parameter for it into __MIDL_ProcFormatString. During the INITOUT phase, client_do_args will try to read at this address. But we do not generate a _RetVal member for the _PARAM_STRUCTS types used by proxies, this means client_do_args will read out of bound. --- tools/widl/typegen.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/tools/widl/typegen.c b/tools/widl/typegen.c index 6d7ccd30814..be26a58f5d0 100644 --- a/tools/widl/typegen.c +++ b/tools/widl/typegen.c @@ -5241,7 +5241,7 @@ void write_client_call_routine( FILE *file, const type_t *iface, const var_t *fu if (needs_params) { if (has_ret) print_file( file, 1, "%s", "CLIENT_CALL_RETURN _RetVal;\n" ); - write_func_param_struct( file, iface, func->declspec.type, "__params", FALSE ); + write_func_param_struct( file, iface, func->declspec.type, "__params", TRUE ); if (is_object( iface )) print_file( file, 1, "__params.This = This;\n" ); if (args) LIST_FOR_EACH_ENTRY( arg, args, const var_t, entry )