From: Vadim Zeitlin <vadim@wxwidgets.org>
Date: Fri, 2 Apr 2010 19:30:34 +0000 (+0000)
Subject: Fix crash in wxMediaCtrl::GetDownloadProgress() with ActiveMovie backend.
X-Git-Url: https://git.saurik.com/wxWidgets.git/commitdiff_plain/f836fe354bc556eabb1d696bc9376c91535695dc?ds=sidebyside;hp=bd044e27b3c7f9b6d56e75b9e1b789be3545cd5e

Fix crash in wxMediaCtrl::GetDownloadProgress() with ActiveMovie backend.

IActiveMovie::get_FilterGraph() may return S_FALSE, i.e. succeed, while
leaving the output pointer NULL. Check for this and don't dereference the
pointer before checking for its validity.

Also do it for the other call in this function just in case. And rearrange the
code to be slightly more readable.

Closes #11894.

git-svn-id: https://svn.wxwidgets.org/svn/wx/wxWidgets/trunk@63831 c3d73ce0-8a6f-49c7-b76d-6d57e0e08775
---

diff --git a/src/msw/mediactrl_am.cpp b/src/msw/mediactrl_am.cpp
index 66db8cf30a..dd80e3963d 100644
--- a/src/msw/mediactrl_am.cpp
+++ b/src/msw/mediactrl_am.cpp
@@ -2092,36 +2092,37 @@ void wxAMMediaBackend::DoGetDownloadProgress(wxLongLong* pLoadProgress,
                                              wxLongLong* pLoadTotal)
 {
 #ifndef __WXWINCE__
-    LONGLONG loadTotal = 0, loadProgress = 0;
-    IUnknown* pFG;
-    IAMOpenProgress* pOP;
-    HRESULT hr;
-    hr = m_pAM->get_FilterGraph(&pFG);
-    if(SUCCEEDED(hr))
+    IUnknown* pFG = NULL;
+
+    HRESULT hr = m_pAM->get_FilterGraph(&pFG);
+
+    // notice that the call above may return S_FALSE and leave pFG NULL
+    if(SUCCEEDED(hr) && pFG)
     {
+        IAMOpenProgress* pOP = NULL;
         hr = pFG->QueryInterface(IID_IAMOpenProgress, (void**)&pOP);
-        if(SUCCEEDED(hr))
-    {
+        if(SUCCEEDED(hr) && pOP)
+        {
+            LONGLONG
+                loadTotal = 0,
+                loadProgress = 0;
             hr = pOP->QueryProgress(&loadTotal, &loadProgress);
             pOP->Release();
+
+            if(SUCCEEDED(hr))
+            {
+                *pLoadProgress = loadProgress;
+                *pLoadTotal = loadTotal;
+                pFG->Release();
+                return;
+            }
         }
         pFG->Release();
     }
+#endif // !__WXWINCE__
 
-    if(SUCCEEDED(hr))
-    {
-        *pLoadProgress = loadProgress;
-        *pLoadTotal = loadTotal;
-    }
-    else
-#endif
-    {
-        // When not loading from a URL QueryProgress will return
-        // E_NOINTERFACE or whatever
-        // wxAMFAIL(hr);
-        *pLoadProgress = 0;
-        *pLoadTotal = 0;
-    }
+    *pLoadProgress = 0;
+    *pLoadTotal = 0;
 }
 
 //---------------------------------------------------------------------------