fix(WeaselTSF): client dump caused by dereferencing nullptr during CEndCompositionEditSession::DoEditSession

Author: fxliang

WeaselTSF/Composition.cpp

@@ -106,14 +106,19 @@ STDAPI CEndCompositionEditSession::DoEditSession(TfEditCookie ec) {
   /* Clear the dummy text we set before, if any. */
   if (_pComposition == nullptr)
     return S_OK;
+  // Avoid null pointer dereference
+  if (!_pTextService || !_pContext)
+    return S_OK;
 
   _pTextService->_ClearCompositionDisplayAttributes(ec, _pContext);
 
-  ITfRange* pCompositionRange;
+  com_ptr<ITfRange> pCompositionRange;
   if (_clear && _pComposition->GetRange(&pCompositionRange) == S_OK)
     pCompositionRange->SetText(ec, 0, L"", 0);
 
   _pComposition->EndComposition(ec);
+  if (!_pTextService)
+    return S_OK;  // _pTextService released, skip _FinalizeComposition
   _pTextService->_FinalizeComposition();
   return S_OK;
 }

WeaselTSF/DisplayAttribute.cpp

@@ -4,8 +4,8 @@
 
 void WeaselTSF::_ClearCompositionDisplayAttributes(TfEditCookie ec,
                                                    _In_ ITfContext* pContext) {
-  ITfRange* pRangeComposition = nullptr;
-  ITfProperty* pDisplayAttributeProperty = nullptr;
+  com_ptr<ITfRange> pRangeComposition = nullptr;
+  com_ptr<ITfProperty> pDisplayAttributeProperty = nullptr;
 
   if (FAILED(_pComposition->GetRange(&pRangeComposition))) {
     return;
@@ -14,17 +14,13 @@ void WeaselTSF::_ClearCompositionDisplayAttributes(TfEditCookie ec,
   if (SUCCEEDED(pContext->GetProperty(GUID_PROP_ATTRIBUTE,
                                       &pDisplayAttributeProperty))) {
     pDisplayAttributeProperty->Clear(ec, pRangeComposition);
-
-    pDisplayAttributeProperty->Release();
   }
-
-  pRangeComposition->Release();
 }
 
 BOOL WeaselTSF::_SetCompositionDisplayAttributes(TfEditCookie ec,
                                                  _In_ ITfContext* pContext,
                                                  ITfRange* pRangeComposition) {
-  ITfProperty* pDisplayAttributeProperty = nullptr;
+  com_ptr<ITfProperty> pDisplayAttributeProperty = nullptr;
   HRESULT hr = S_OK;
 
   if (pRangeComposition == nullptr)
@@ -40,10 +36,7 @@ BOOL WeaselTSF::_SetCompositionDisplayAttributes(TfEditCookie ec,
     VARIANT var;
     var.vt = VT_I4;  // we're going to set a TfGuidAtom
     var.lVal = _gaDisplayAttributeInput;
-
     hr = pDisplayAttributeProperty->SetValue(ec, pRangeComposition, &var);
-
-    pDisplayAttributeProperty->Release();
   }
 
   // DO NOT release range composition here
@@ -53,7 +46,7 @@ BOOL WeaselTSF::_SetCompositionDisplayAttributes(TfEditCookie ec,
 }
 
 BOOL WeaselTSF::_InitDisplayAttributeGuidAtom() {
-  ITfCategoryMgr* pCategoryMgr = nullptr;
+  com_ptr<ITfCategoryMgr> pCategoryMgr = nullptr;
   HRESULT hr =
       CoCreateInstance(CLSID_TF_CategoryMgr, nullptr, CLSCTX_INPROC_SERVER,
                        IID_ITfCategoryMgr, (void**)&pCategoryMgr);
@@ -69,7 +62,5 @@ BOOL WeaselTSF::_InitDisplayAttributeGuidAtom() {
   }
 
 Exit:
-  pCategoryMgr->Release();
-
   return (hr == S_OK);
 }