{"id":15623,"date":"2009-12-18T07:00:00","date_gmt":"2009-12-18T07:00:00","guid":{"rendered":"https:\/\/blogs.msdn.microsoft.com\/oldnewthing\/2009\/12\/18\/i-got-an-array-with-plenty-of-nuthin\/"},"modified":"2009-12-18T07:00:00","modified_gmt":"2009-12-18T07:00:00","slug":"i-got-an-array-with-plenty-of-nuthin","status":"publish","type":"post","link":"https:\/\/devblogs.microsoft.com\/oldnewthing\/20091218-00\/?p=15623","title":{"rendered":"I got an array with plenty of nuthin'"},"content":{"rendered":"

\nA customer reported a memory leak in the function\nPropVariantClear<\/code>:\n<\/p>\n

\n

\nWe found the following memory leak in the function\nPropVariantClear<\/code>.\nPlease fix it immediately because it causes our program to\nrun out of memory.\n<\/p>\n

\nIf the PROPVARIANT<\/code>‘s type is VT_ARRAY<\/code>,\nthen the corresponding SAFEARRAY<\/code> is leaked and not\ncleaned up.\n<\/p>\n

\nSAFEARRAY* psa = SafeArrayCreateVector(VT_UNKNOWN, 0, 1);\nPROPVARIANT v;\nv.vt = VT_ARRAY;\nv.parray = psa;\nPropVariantClear(&v);\n\/\/ The psa is leaked\n<\/pre>\n
\nRight now, we are temporarily working around this in our program\nby inserting code before all calls to\nPropVariantClear<\/code> to free the SAFEARRAY<\/code>,\nbut this is clearly an unsatisfactory solution\nbecause it will merely result in double-free bugs once you fix\nthe bug.\nPlease give this defect your highest priority as it is holding up\ndeployment of our system.\n<\/p>\n<\/blockquote>\n
\nThe VT_ARRAY<\/code> value is not a variant type in and of itself;\nit is a type modifier<\/i>.\nThere are other type modifiers, such as\nVT_VECTOR<\/code>\nand VT_BYREF<\/code>.\nThe thing about modifiers is that they need to modify something<\/i>.\n<\/p>\n
\nThe line\nv.vt = VT_ARRAY<\/code> is incorrect.\nYou have to say what you have a safe array of<\/i>.\nIn this case, you want v.vt = VT_ARRAY | VT_UNKNOWN<\/code>.\nOnce you change that, you’ll find the memory leak is fixed.\n<\/p><\/blockquote>\n
\nThe customer didn’t believe this explanation.\n<\/p>\n
\n
\nI find this doubtful for several reasons.\n<\/p>\n
    \n
  1. While this would explain why the\n    IUnknown<\/code>s in the SAFEARRAY<\/code>\n    are not released,\n    it doesn’t explain why the SAFEARRAY<\/code> itself is leaked.<\/p>\n
  2. The SAFEARRAY<\/code> already contains this information,\n    so it should already know that destroying it entails releasing\n    the IUnknown<\/code> pointers.<\/p>\n
  3. If I manually call SafeArrayDestroy<\/code>,\n    then the IUnknown<\/code>s are correctly\n    released, confirming point 2.<\/p>\n
  4. The function SafeArrayDestroy<\/code> is never called;\n    that is the root cause of the problem.\n<\/ol>\n<\/blockquote>\n
    \nThe customer’s mental model of PropVariantDestroy<\/code>\nappeared to be that it should go something like this:\n<\/p>\n
    \nif (pvt->vt & VT_ARRAY) {\n switch (pvt->vt & VT_TYPEMASK) {\n ...\n case VT_UNKNOWN:\n  ... release the IUnknowns in the SAFEARRAY...\n  break;\n ...\n }\n InternalFree(pvt->psa->pvData);\n InternalFree(pvt->psa);\n return S_OK;\n}\n<\/pre>\n
    \nIn fact what’s really going on is that the value of\nVT_ARRAY<\/code> is interpreted as\nVT_ARRAY | VT_EMPTY<\/code>,\nbecause (1) VT_ARRAY<\/code> is a modifier,\nso it has to modify something, and (2) the\nnumeric value of zero happens to be equal to VT_EMPTY<\/code>.\nIn other words, you told OLE automation that your PROPVARIANT<\/code>\nholds a SAFEARRAY<\/code> filled with VT_EMPTY<\/code>.\n<\/p>\n
    \nIt also happens that a SAFEARRAY<\/code> of VT_EMPTY<\/code>\nis illegal.\nOnly certain types can be placed in a SAFEARRAY<\/code>,\nand VT_EMPTY<\/code> is not one of them.\n<\/p>\n
    \nThe call to PropVariantClear<\/code> was returning the\nerror\nDISP_E_BADVARTYPE<\/code>.\nIt was performing parameter validation and rejecting the property\nvariant as invalid,\nbecause you can’t have an array of nothing.\nThe customer’s response to this explanation was very terse.\n<\/p>\n
    \nTx. Interesting.\n<\/p><\/blockquote>\n","protected":false},"excerpt":{"rendered":"
    A customer reported a memory leak in the function PropVariantClear: We found the following memory leak in the function PropVariantClear. Please fix it immediately because it causes our program to run out of memory. If the PROPVARIANT‘s type is VT_ARRAY, then the corresponding SAFEARRAY is leaked and not cleaned up. SAFEARRAY* psa = SafeArrayCreateVector(VT_UNKNOWN, 0, […]<\/p>\n","protected":false},"author":1069,"featured_media":111744,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[25],"class_list":["post-15623","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-oldnewthing","tag-code"],"acf":[],"blog_post_summary":"
    A customer reported a memory leak in the function PropVariantClear: We found the following memory leak in the function PropVariantClear. Please fix it immediately because it causes our program to run out of memory. If the PROPVARIANT‘s type is VT_ARRAY, then the corresponding SAFEARRAY is leaked and not cleaned up. SAFEARRAY* psa = SafeArrayCreateVector(VT_UNKNOWN, 0, […]<\/p>\n","_links":{"self":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/posts\/15623","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/users\/1069"}],"replies":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/comments?post=15623"}],"version-history":[{"count":0,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/posts\/15623\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/media\/111744"}],"wp:attachment":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/media?parent=15623"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/categories?post=15623"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/tags?post=15623"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}