From 66fe6841b8dc6ae998cdd5409f50975504dc3b98 Mon Sep 17 00:00:00 2001 From: Damjan Jovanovic Date: Sun, 20 Jun 2021 18:08:02 +0200 Subject: [PATCH] msxml3: Return S_FALSE from IXMLDOMNamedNodeMap::nextNode() when there are no attributes. Currently Wine return S_FALSE when IXMLDOMNamedNodeMap::nextNode() has run out of attributes to return, but when an XML node has no attributes at all, it returns S_OK despite setting the nextNode output parameter to NULL, causing the caller to crash when it accesses this pointer. Return S_FALSE in this case instead. Wine-Bug: https://bugs.winehq.org/show_bug.cgi?id=50603 Signed-off-by: Damjan Jovanovic Signed-off-by: Nikolay Sivov Signed-off-by: Alexandre Julliard (cherry picked from commit 06cd8d3d2eb09ffb19f26e95360c3ddcc4caf46d) Signed-off-by: Michael Stefaniuc --- dlls/msxml3/element.c | 2 ++ dlls/msxml3/tests/domdoc.c | 25 +++++++++++++++++++++++++ 2 files changed, 27 insertions(+) diff --git a/dlls/msxml3/element.c b/dlls/msxml3/element.c index 05255508d4e..de5d32c585b 100644 --- a/dlls/msxml3/element.c +++ b/dlls/msxml3/element.c @@ -1888,6 +1888,8 @@ static HRESULT domelem_next_node(const xmlNodePtr node, LONG *iter, IXMLDOMNode *nextNode = NULL; curr = node->properties; + if (curr == NULL) + return S_FALSE; for (i = 0; i < *iter; i++) { if (curr->next == NULL) diff --git a/dlls/msxml3/tests/domdoc.c b/dlls/msxml3/tests/domdoc.c index e94a2c88a81..a64bc5bc2b0 100644 --- a/dlls/msxml3/tests/domdoc.c +++ b/dlls/msxml3/tests/domdoc.c @@ -2203,6 +2203,8 @@ static void test_domnode( void ) if (element) { + IXMLDOMNamedNodeMap *attributes; + owner = NULL; r = IXMLDOMElement_get_ownerDocument( element, &owner ); ok( r == S_OK, "get_ownerDocument return code\n"); @@ -2281,6 +2283,29 @@ static void test_domnode( void ) ok( map != NULL, "should be attributes\n"); EXPECT_CHILDREN(element); + + r = IXMLDOMElement_get_childNodes( element, &list ); + ok( r == S_OK, "Expected S_OK, ret %08x\n", r ); + r = IXMLDOMNodeList_nextNode( list, &node ); /* */ + ok( r == S_OK, "Expected S_OK, ret %08x\n", r ); + IXMLDOMNode_Release( node ); + r = IXMLDOMNodeList_nextNode( list, &node ); /* */ + ok( r == S_OK, "Expected S_OK, ret %08x\n", r ); + IXMLDOMNode_Release( node ); + r = IXMLDOMNodeList_nextNode( list, &node ); /* */ + ok( r == S_OK, "Expected S_OK, ret %08x\n", r ); + r = IXMLDOMNode_get_attributes( node, &attributes ); + ok( r == S_OK, "Expected S_OK, ret %08x\n", r ); + next = (IXMLDOMNode*)0xdeadbeef; + r = IXMLDOMNamedNodeMap_nextNode( attributes, &next ); + ok( r == S_FALSE, "Expected S_FALSE, ret %08x\n", r ); + ok( next == NULL, "Expected NULL, ret %p\n", next ); + IXMLDOMNamedNodeMap_Release( attributes ); + IXMLDOMNode_Release( node ); + node = NULL; + next = NULL; + IXMLDOMNodeList_Release( list ); + list = NULL; } else ok( FALSE, "no element\n");