From: Jacek Caban <jacek@codeweavers.com>
Subject: [PATCH 2/9] vbscript: Fix NULL IDispatch handling in get_disp_value.
Message-Id: <b018a21e-ed2b-06f5-5656-21273b7962e0@codeweavers.com>
Date: Fri, 18 Oct 2019 16:20:09 +0200

Signed-off-by: Jacek Caban <jacek@codeweavers.com>
---
  dlls/vbscript/interp.c        | 23 ++++++++++++++---------
  dlls/vbscript/tests/lang.vbs  | 22 ++++++++++++++++++++++
  dlls/vbscript/vbdisp.c        |  2 ++
  dlls/vbscript/vbscript.rc     |  1 +
  dlls/vbscript/vbscript_defs.h |  1 +
  5 files changed, 40 insertions(+), 9 deletions(-)

diff --git a/dlls/vbscript/interp.c b/dlls/vbscript/interp.c
index 251fd785cf..80ecc41699 100644
--- a/dlls/vbscript/interp.c
+++ b/dlls/vbscript/interp.c
@@ -319,7 +319,7 @@ static HRESULT stack_pop_val(exec_ctx_t *ctx, variant_val_t *r)
         HRESULT hres;
 
         hres = get_disp_value(ctx->script, V_DISPATCH(r->v), &r->store);
-        if(r->owned)
+        if(r->owned && V_DISPATCH(r->v))
             IDispatch_Release(V_DISPATCH(r->v));
         if(FAILED(hres))
             return hres;
@@ -350,7 +350,8 @@ static HRESULT stack_assume_val(exec_ctx_t *ctx, unsigned n)
 
         disp = V_DISPATCH(v);
         hres = get_disp_value(ctx->script, disp, v);
-        IDispatch_Release(disp);
+        if(disp)
+            IDispatch_Release(disp);
         if(FAILED(hres))
             return hres;
     }
@@ -688,23 +689,27 @@ static HRESULT interp_mcallv(exec_ctx_t *ctx)
 
 static HRESULT assign_value(exec_ctx_t *ctx, VARIANT *dst, VARIANT *src, WORD flags)
 {
+    VARIANT value;
     HRESULT hres;
 
-    hres = VariantCopyInd(dst, src);
+    V_VT(&value) = VT_EMPTY;
+    hres = VariantCopyInd(&value, src);
     if(FAILED(hres))
         return hres;
 
-    if(V_VT(dst) == VT_DISPATCH && !(flags & DISPATCH_PROPERTYPUTREF)) {
-        VARIANT value;
+    if(V_VT(&value) == VT_DISPATCH && !(flags & DISPATCH_PROPERTYPUTREF)) {
+        IDispatch *disp = V_DISPATCH(&value);
 
-        hres = get_disp_value(ctx->script, V_DISPATCH(dst), &value);
-        IDispatch_Release(V_DISPATCH(dst));
+        V_VT(&value) = VT_EMPTY;
+        hres = get_disp_value(ctx->script, disp, &value);
+        if(disp)
+            IDispatch_Release(disp);
         if(FAILED(hres))
             return hres;
-
-        *dst = value;
     }
 
+    VariantClear(dst);
+    *dst = value;
     return S_OK;
 }
 
diff --git a/dlls/vbscript/tests/lang.vbs b/dlls/vbscript/tests/lang.vbs
index 5d9fb80617..6ddb2e79f5 100644
--- a/dlls/vbscript/tests/lang.vbs
+++ b/dlls/vbscript/tests/lang.vbs
@@ -1354,6 +1354,28 @@ end class
 set x = new RegExp
 Call ok(x.Global = false, "x.Global = " & x.Global)
 
+sub test_nothing_errors
+    dim x
+    on error resume next
+
+    x = 1
+    err.clear
+    x = nothing
+    call ok(err.number = 91, "err.number = " & err.number)
+    call ok(x = 1, "x = " & x)
+
+    err.clear
+    x = not nothing
+    call ok(err.number = 91, "err.number = " & err.number)
+    call ok(x = 1, "x = " & x)
+
+    err.clear
+    x = "" & nothing
+    call ok(err.number = 91, "err.number = " & err.number)
+    call ok(x = 1, "x = " & x)
+end sub
+call test_nothing_errors()
+
 sub test_identifiers
     ' test keywords that can also be a declared identifier
     Dim default
diff --git a/dlls/vbscript/vbdisp.c b/dlls/vbscript/vbdisp.c
index cb902b9bc5..1dd6d4ed05 100644
--- a/dlls/vbscript/vbdisp.c
+++ b/dlls/vbscript/vbdisp.c
@@ -967,6 +967,8 @@ HRESULT disp_call(script_ctx_t *ctx, IDispatch *disp, DISPID id, DISPPARAMS *dp,
 HRESULT get_disp_value(script_ctx_t *ctx, IDispatch *disp, VARIANT *v)
 {
     DISPPARAMS dp = {NULL};
+    if(!disp)
+        return MAKE_VBSERROR(VBSE_OBJECT_VARIABLE_NOT_SET);
     return disp_call(ctx, disp, DISPID_VALUE, &dp, v);
 }
 
diff --git a/dlls/vbscript/vbscript.rc b/dlls/vbscript/vbscript.rc
index e1d84501ba..360b1006d6 100644
--- a/dlls/vbscript/vbscript.rc
+++ b/dlls/vbscript/vbscript.rc
@@ -37,6 +37,7 @@ STRINGTABLE
     VBSE_PERMISSION_DENIED             "Permission denied"
     VBSE_PATH_FILE_ACCESS              "Path/File access error"
     VBSE_PATH_NOT_FOUND                "Path not found"
+    VBSE_OBJECT_VARIABLE_NOT_SET       "Object variable not set"
     VBSE_ILLEGAL_NULL_USE              "Invalid use of Null"
     VBSE_CANT_CREATE_TMP_FILE          "Can't create necessary temporary file"
     VBSE_CANT_CREATE_OBJECT            "ActiveX component can't create object"
diff --git a/dlls/vbscript/vbscript_defs.h b/dlls/vbscript/vbscript_defs.h
index 42c1ff5786..44f005b640 100644
--- a/dlls/vbscript/vbscript_defs.h
+++ b/dlls/vbscript/vbscript_defs.h
@@ -250,6 +250,7 @@
 #define VBSE_PERMISSION_DENIED             70
 #define VBSE_PATH_FILE_ACCESS              75
 #define VBSE_PATH_NOT_FOUND                76
+#define VBSE_OBJECT_VARIABLE_NOT_SET       91
 #define VBSE_ILLEGAL_NULL_USE              94
 #define VBSE_CANT_CREATE_TMP_FILE         322
 #define VBSE_CANT_CREATE_OBJECT           429