Commit 9d645a972d for qemu.org

commit 9d645a972d788e4494ddd0a618fe2e44a0b8b849
Author: Marc-André Lureau <marcandre.lureau@redhat.com>
Date:   Mon Sep 7 14:50:05 2026 +0400

    qga/vss-win32: allow pceltFetched==NULL in IEnumObject::Next

    The COM IEnumXxx/IEnumUnknown::Next API allows callers to pass NULL for
    pceltFetched when celt is 1. Guard the write to prevent crashing.

    Fixes: b39297aedfab ("qemu-ga: Add Windows VSS provider and requester as DLL")
    Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
    Reviewed-by: Kostiantyn Kostiuk <kkostiuk@redhat.com>
    Link: https://lore.kernel.org/qemu-devel/20260907-qga-v1-7-86456ad356e2@redhat.com
    Signed-off-by: Kostiantyn Kostiuk <kkostiuk@redhat.com>

diff --git a/qga/vss-win32/provider.cpp b/qga/vss-win32/provider.cpp
index 79906dcc24..377571b948 100644
--- a/qga/vss-win32/provider.cpp
+++ b/qga/vss-win32/provider.cpp
@@ -117,7 +117,9 @@ STDMETHODIMP_(ULONG) CQGAVSSEnumObject::Release()
 STDMETHODIMP CQGAVSSEnumObject::Next(
     ULONG celt, VSS_OBJECT_PROP *rgelt, ULONG *pceltFetched)
 {
-    *pceltFetched = 0;
+    if (pceltFetched) {
+        *pceltFetched = 0;
+    }
     return S_FALSE;
 }