emit_marshal_string: For the MARSHAL_ACTION_MANAGED_CONV_IN case check,

 the param for the out attribute.  Do not call ptr to string if the
 out exists.  This avoids reading uninitialized memory.

diff --git a/mono/metadata/marshal.c b/mono/metadata/marshal.c
index c51cbd066e7a92ef82a561f62878133448f4e97f..0e19fbf4e781237868e10a7789da8281fb36c4f9 100644 (file)
--- a/mono/metadata/marshal.c
+++ b/mono/metadata/marshal.c
@@ -6170,6 +6170,11 @@ emit_marshal_string (EmitMarshalContext *m, int argnum, MonoType *t,
 
                *conv_arg_type = &mono_defaults.int_class->byval_arg;
 
+               if (t->byref) {
+                       if (t->attrs & PARAM_ATTRIBUTE_OUT)
+                               break;
+               }
+
                conv = mono_marshal_get_ptr_to_string_conv (m->piinfo, spec, &need_free);
                if (conv == -1) {
                        char *msg = g_strdup_printf ("string marshalling conversion %d not implemented", encoding);