Returning BSTR to ActiveX crashes IE7

Hello,

I'm encountering an issue where calling a simple one method ATL ActiveX
control is crashing IE7. Here's a copy of the Javascript and the C++. The
component is build using VS 2005. The control also leverages the SiteLock
template.

My suspicious is that I'm not building up the BSTR correctly and a memory
leak is occurring.

function GetInfo()
{
    var strInfo = "";
    var detObj = Detector1;
    if(detObj != null)
    {
        try
        {
            strInfo = detObj.GetInfo();
        
            var frmOffer = document.forms[0];
            if(frmOffer != null)
            {
                var hdnInfo =
document.getElementById('<%=hdnInfo.ClientID%>');
                if(hdnInfo != null)
                {
                    hdnInfo.value = strInfo;
                    frmOffer.submit();
                }
            }
        }
            catch(err)
        {
            // ActiveX was not installed (i.e., 1st page load before install)
        }
    }
    else
    {
        strInfo = "Still checking. This may take a few minutes.";
    }
}

</script>

STDMETHODIMP CDetector::GetInfo(BSTR* output)
{

    try
    {
        CComBSTR strInfo;

        strInfo += L"~@model@~";
        strInfo += _bstr_t(m_Model, true); //m_Model is a BSTR
        strInfo += L"~@/model@~";

        strInfo.CopyTo(output);

        SysFreeString(strInfo);
    }

    catch( char *str )
    {
      cout << "Exception caught : " << str << "\n";
    }

    return S_OK;
}