From 5ff15e2651850ba30dde69056436b8774fac9166 Mon Sep 17 00:00:00 2001
From: "Christoph M. Becker" <cmbecker69@gmx.de>
Date: Wed, 26 Aug 2020 14:45:13 +0200
Subject: [PATCH] Fix #64130: COM obj parameters passed by reference are not
 updated

`ITypeInfo_GetIDsOfNames()` is supposed to fail with `E_NOTIMPL` for
out-of-process servers, thus we should not remove the already available
typeinfo of the object in this case.

We also properly free the `byref_vals`.
---
 NEWS                               |  4 ++++
 ext/com_dotnet/com_com.c           |  4 +++-
 ext/com_dotnet/tests/bug64130.phpt | 27 +++++++++++++++++++++++++++
 3 files changed, 34 insertions(+), 1 deletion(-)
 create mode 100644 ext/com_dotnet/tests/bug64130.phpt

diff --git a/NEWS b/NEWS
index 96668780566..722f0a70705 100644
--- a/NEWS
+++ b/NEWS
@@ -6,6 +6,10 @@ PHP                                                                        NEWS
   . Fixed bug #80007 (Potential type confusion in unixtojd() parameter parsing).
     (Andy Postnikov)
 
+- COM:
+  . Fixed bug #64130 (COM obj parameters passed by reference are not updated).
+    (cmb)
+
 - OPcache:
   . Fixed bug #80002 (calc free space for new interned string is wrong).
     (t-matsuno)
diff --git a/ext/com_dotnet/com_com.c b/ext/com_dotnet/com_com.c
index c9962835d14..5c6cc5ab14a 100644
--- a/ext/com_dotnet/com_com.c
+++ b/ext/com_dotnet/com_com.c
@@ -439,8 +439,9 @@ HRESULT php_com_get_id_of_name(php_com_dotnet_object *obj, char *name,
 	if (obj->typeinfo) {
 		hr = ITypeInfo_GetIDsOfNames(obj->typeinfo, &olename, 1, dispid);
 		if (FAILED(hr)) {
+			HRESULT hr1 = hr;
 			hr = IDispatch_GetIDsOfNames(V_DISPATCH(&obj->v), &IID_NULL, &olename, 1, LOCALE_SYSTEM_DEFAULT, dispid);
-			if (SUCCEEDED(hr)) {
+			if (SUCCEEDED(hr) && hr1 != E_NOTIMPL) {
 				/* fall back on IDispatch direct */
 				ITypeInfo_Release(obj->typeinfo);
 				obj->typeinfo = NULL;
@@ -588,6 +589,7 @@ int php_com_do_invoke_byref(php_com_dotnet_object *obj, zend_internal_function *
 			}
 		}
 		efree(vargs);
+		if (byref_vals) efree(byref_vals);
 	}
 
 	return SUCCEEDED(hr) ? SUCCESS : FAILURE;
diff --git a/ext/com_dotnet/tests/bug64130.phpt b/ext/com_dotnet/tests/bug64130.phpt
new file mode 100644
index 00000000000..0f8e083295c
--- /dev/null
+++ b/ext/com_dotnet/tests/bug64130.phpt
@@ -0,0 +1,27 @@
+--TEST--
+Bug #64130 (COM obj parameters passed by reference are not updated)
+--SKIPIF--
+<?php
+if (!extension_loaded('com_dotnet')) die('skip com_dotnet extension not available');
+if (PHP_INT_SIZE != 4) die('skip for 32bit platforms only');
+try {
+    $ie = new com('InternetExplorer.Application');
+} catch (com_exception $ex) {
+    die("skip {$ex->getMessage()}");
+}
+$ie->quit();
+?>
+--FILE--
+<?php
+$ie = new com('InternetExplorer.Application');
+$x = 0;
+$y = 0;
+try {
+    $ie->clientToWindow($x, $y);
+} catch (com_exception $ex) {}
+var_dump($x > 0, $y > 0);
+$ie->quit();
+?>
+--EXPECT--
+bool(true)
+bool(true)