CVE-2021-45681

Name of the Vulnerable Software and Affected Versions: derive-com-impl crate versions prior to 0.1.2

Description: An issue in the derive-com-impl crate can cause an invalid reference and memory corruption because the AddRef method might not be called before returning a pointer. The QueryInterface method implementation is faulty, as it does not call IUnknown::AddRef before returning the pointer, which can lead to an invalid reference when IUnknown::Release is called. This is due to the reference count not being incremented as expected.

Recommendations: For versions prior to 0.1.2, the only way to quick fix this is to use the macro expanded version of the code and modify the QueryInterface method to add the AddRef call yourself.