re: Calling VariantClear on a OUT param can lead to security hole !!!

pweerd — Wed, 01 Apr 2009 10:00:34 GMT

Hi Jaiprakash,

I'm not sure if this is right. I had the same feeling about it and programmed my COM-object in that way. But it is leaking memory when called from VBScript. There is not much documentation about who is responsible for freeing VARIANTS in COM.

Many people are using VARIANTs by always initializing and always cleaining them.

My COM object declared the following method:

HRESULT Test ([out]VARIANT *Value);

and in them implementation I did fill it with a string, without calling VariantClear().

VBScript code:

dim i, obj, v

set obj = CreateObject ("myobject")

for i=0 to 1000000

obj.Test v

v was correctly filled, but it is leaking fast.

This behaviour is different when you change the attribute from [out] into [out,retval]. After that its not leaking any more. The VBScript code is than:

dim i, obj, v

set obj = CreateObject ("myobject")

for i=0 to 1000000

v = obj.Test

Regards,

Peter vd Weerd