FIX: COleDispatchDriver::InvokeHelperV Causes Memory Leaks

The information in this article applies to:

   The Microsoft Foundation Classes (MFC), included with
     - Microsoft Visual C++ for Windows, version 1.5

SYMPTOMS

Creating a COleDispatchDriver derived class from an automation object's type library for a particular object may result in a memory leak when subsequently calling its member functions. This leak is caused by a bug in the InvokeHelperV member function of the COleDispatchDriver class used by the member functions of the derived class to call the OLE automation object's methods.

CAUSE

COleDispatchDriver::InvokeHelperV function, eventually called by all method member functions, incorrectly calculates the parameter information and will not free memory associated with BSTR (String) parameters. The error is marked below in a small segment taken from the COleDispatchDriver::InvokeHelperV function:

void COleDispatchDriver::InvokeHelperV(DISPID dwDispID, WORD wFlags,
                                       VARTYPE vtRet, void* pvRet,
                                       const BYTE FAR* pbParamInfo,
                                       va_list, argList)
{
  ...

  // cleanup any arguments that need cleanup
  if (dispparams.cArgs != 0)
  {
    VARIANTARG FAR* pArg = dispparams.rgvarg;
    // BUG: wrong start address
    // the correct line included in Visual C++ 1.51:
    // VARIANTARG FAR* pArg = dispparams.rgvarg + dispparams.cArgs - 1;

    const BYTE FAR* pb = pbParamInfo;
    while (*pb != 0)
    {
      switch ((VARTYPE)*pb)
      {
        case VT_BSTR:
          VariantClear(pArg); // BUG: wrong address gets passed since
                              // initial calculation was wrong
          break;
        ...
      }
      ++pArg;
     // BUG: wrong direction for parameters (they're in reverse order)
     // the correct line included in Visual C++ 1.51:
     // --pArg;
      ++pb;
    }
  }
  ....

STATUS

Microsoft has confirmed this to be a bug in the Microsoft products listed at the beginning of this article. This bug was corrected in the Microsoft Foundation Classes version 2.51 that was included with Microsoft Visual C++ version 1.51 for Windows.