From 9c73a2344d994d1852e0968fcadc7bc40e7d06e7 Mon Sep 17 00:00:00 2001
From: Arkady Trestman <atrestman@users.sourceforge.net>
Date: Thu, 3 Dec 2009 23:53:53 +0000
Subject: [PATCH] additional error checking to prevent accidental range
 over-reference

---
 direct/src/plugin_activex/PPPandaObject.cpp | 38 ++++++++++++---------
 1 file changed, 22 insertions(+), 16 deletions(-)

diff --git a/direct/src/plugin_activex/PPPandaObject.cpp b/direct/src/plugin_activex/PPPandaObject.cpp
index 12ec4d8fae..f8432e0556 100644
--- a/direct/src/plugin_activex/PPPandaObject.cpp
+++ b/direct/src/plugin_activex/PPPandaObject.cpp
@@ -59,6 +59,21 @@ STDMETHODIMP_(unsigned long) PPandaObject::Release()
     return m_refs;
 }
 
+STDMETHODIMP PPandaObject::QueryInterface(REFIID riid, void FAR* FAR* ppv)
+{
+    if(!IsEqualIID(riid, IID_IUnknown))
+    {
+        if(!IsEqualIID(riid, IID_IDispatch)) 
+        {
+            *ppv = NULL;      
+            return E_NOINTERFACE;
+        }
+    }
+    *ppv = this;
+    AddRef();
+    return NOERROR;
+}
+
 STDMETHODIMP PPandaObject::GetIDsOfNames(
     REFIID riid,
     OLECHAR FAR* FAR* rgszNames,
@@ -139,6 +154,8 @@ STDMETHODIMP PPandaObject::Invoke(
     unsigned int FAR* puArgErr)
 {
     UNUSED(lcid);
+    HRESULT hr( S_OK );
+
 
     if(!IsEqualIID(riid, IID_NULL))
     {
@@ -149,8 +166,12 @@ STDMETHODIMP PPandaObject::Invoke(
         return E_FAIL;
     }
 
+    if ( dispidMember >= m_idsOfNames.size( ) ) 
+    {
+        return E_FAIL;
+    }
+
     CString& name( m_idsOfNames[dispidMember] );
-    HRESULT hr( S_OK );
 
     switch ( wFlags )
     {
@@ -183,18 +204,3 @@ STDMETHODIMP PPandaObject::Invoke(
     }
     return hr;
 }
-
-STDMETHODIMP PPandaObject::QueryInterface(REFIID riid, void FAR* FAR* ppv)
-{
-    if(!IsEqualIID(riid, IID_IUnknown))
-    {
-        if(!IsEqualIID(riid, IID_IDispatch)) 
-        {
-            *ppv = NULL;      
-            return E_NOINTERFACE;
-        }
-    }
-    *ppv = this;
-    AddRef();
-    return NOERROR;
-}