DllGetClassObject does not reliably initialize its out pararameter

[rgatkinson]

runtime/src/native/corehost/comhost/comhost.cpp

Line 196 in 4da638d

COM_API HRESULT STDMETHODCALLTYPE DllGetClassObject(

COM out parameters should always be initialized, even in failure cases. Here, DllGetClassObject has code paths that return failure HRESULTs without initializing *ppv. A simple *ppv = nullptr; at the top of the function would do the trick.

[dotnet-policy-service]

Tagging subscribers to this area: @dotnet/interop-contrib
See info in area-owners.md if you want to be subscribed.