BUG: Access Violation When Calling COleVariant::Clear()

• Microsoft Visual C++, 32-bit Enterprise Edition, versions 5.0, 5.0sp1, 5.0sp2

SYMPTOMS

When calling COleVariant::Clear(), an access violation occurs when the variant type is VT_DECIMAL.

CAUSE

There is special code in COleVariant::Clear() that checks the type of the variant and calls SysFreeString() if it is equal to VT_BSTRT (14). Here is the code:

   #ifndef _UNICODE
      if (vt == VT_BSTRT)
             ::SysFreeString(bstrVal);
      else
   #endif
      {
             VERIFY(::VariantClear(this) == NOERROR);
      }

Thus, if you call Clear() on a COleVariant, which has a variant type of VT_DECIMAL, an access violation will occur because the function calls SysFreeString() on a non-existent string.

RESOLUTION

Don't call COleVariant::Clear(); instead, call VariantClear() and pass in the COleVariant.

STATUS

Microsoft has confirmed this to be a bug in the Microsoft products listed at the beginning of this article. We are researching this bug and will post new information here in the Microsoft Knowledge Base as it becomes available.

MORE INFORMATION

The GetRows() ADO sample, which is provided with the OLE DB 1.1 SDK, contains code that can cause the access violation when calling Clear().

Here is the DoGetRows() function from GETRDLG.CPP:

   HRESULT CGetRowsDlg::DoGetRows()
   {
      HRESULT         hr;
      COleVariant      vBookmark, rgvFields;
      COleVariant      cRows;
      COleVariant      varField, varNewField;
      CString         strLBRow;
      LONG         lNumOfCol, lNumRecords;
      LONG         lIndex[2];
      CListBox      *pListBox =
                               (CListBox *)GetDlgItem(IDD_GETROWSLIST);

      //Perform GetRows on Employee table.

      //Start from the current place
      vBookmark.vt = VT_ERROR;
      vBookmark.scode = DISP_E_PARAMNOTFOUND;

      //Get all columns.
      rgvFields.vt = VT_ERROR;
      rgvFields.scode = DISP_E_PARAMNOTFOUND;

   if (!m_piEmpRecordSet)
      return E_NOINTERFACE;

      hr = m_piEmpRecordSet->GetRows(   adGetRowsRest,
                                           vBookmark,
                                           rgvFields,
                                           &cRows
                                         );
      if (FAILED(hr)) goto ErrorExit;


      //Find out how many records were actually retrieved,
      //(SafeArrays are 1-based)
      lNumOfCol = 2;
      SafeArrayGetUBound(cRows.parray, 2, &lNumRecords);

      //Clear the listbox
      pListBox->ResetContent();

      for (lIndex[1] = 0; lIndex[1] <= lNumRecords; lIndex[1]++)
      {
             strLBRow.Empty();//Clear the string
             for (lIndex[0] = 0; lIndex[0] <= lNumOfCol; lIndex[0]++)
             {
               SafeArrayGetElement(cRows.parray, &lIndex[0], &varField);
               hr = VariantChangeType(&varNewField, &varField, 0, VT_BSTR);

               if(hr == S_OK)
               {
                 strLBRow += (LPCWSTR)varNewField.bstrVal;
                 strLBRow += _T(", ");
               }
               varField.Clear();
               varNewField.Clear();
             }
             pListBox->AddString(strLBRow);
           }

      return hr;

   ErrorExit:
      TCHAR szBuf[256];
      wsprintf(szBuf, _T("Error: %d \n"), hr);
      AfxMessageBox(szBuf);

      return hr;
   }

To reproduce the error, add the following lines of code to the function CGetRowsDlg::DoGetRows():

   COleVariant var10;

   hr = VariantChangeType(&var10, &varField, 0, VT_DECIMAL);
   if(hr!=S_OK)
        AfxMessageBox("Can't VariantChangeType to decimal");
   else
       var10.Clear();

    varField.Clear();