Unknown · Derive-Com-Impl · CVE-2021-45681
Name of the Vulnerable Software and Affected Versions:
derive-com-impl crate versions prior to 0.1.2
Description:
An issue in the derive-com-impl crate can cause an invalid reference and memory corruption because the `AddRef` method might not be called before returning a pointer. The `QueryInterface` method implementation is faulty, as it does not call `IUnknown::AddRef` before returning the pointer, which can lead to an invalid reference when `IUnknown::Release` is called. This is due to the reference count not being incremented as expected.
Recommendations:
For versions prior to 0.1.2, the only way to quick fix this is to use the macro expanded version of the code and modify the `QueryInterface` method to add the `AddRef` call yourself.