From c7293055119afa3945154713c4b947eba501f966 Mon Sep 17 00:00:00 2001
From: Michael Karcher <wine@mkarcher.dialup.fu-berlin.de>
Date: Sat, 11 Oct 2008 23:58:02 +0200
Subject: [PATCH] msxml3: Correct handling of listLength == NULL in
 IXMLDOMNamedNodeMap::get_length.

---
 dlls/msxml3/nodemap.c      | 3 +++
 dlls/msxml3/tests/domdoc.c | 3 +++
 2 files changed, 6 insertions(+)

diff --git a/dlls/msxml3/nodemap.c b/dlls/msxml3/nodemap.c
index ae52a4d17d2..b2b1b33b6a8 100644
--- a/dlls/msxml3/nodemap.c
+++ b/dlls/msxml3/nodemap.c
@@ -364,6 +364,9 @@ static HRESULT WINAPI xmlnodemap_get_length(
 
     TRACE("%p\n", This);
 
+    if( !listLength )
+        return E_INVALIDARG;
+
     node = xmlNodePtr_from_domnode( This->node, 0 );
     if ( !node )
         return E_FAIL;
diff --git a/dlls/msxml3/tests/domdoc.c b/dlls/msxml3/tests/domdoc.c
index 653475ec9bc..dda9fbb71e5 100644
--- a/dlls/msxml3/tests/domdoc.c
+++ b/dlls/msxml3/tests/domdoc.c
@@ -1003,6 +1003,9 @@ todo_wine
         SysFreeString( str );
 
 	/* test indexed access of attributes */
+        r = IXMLDOMNamedNodeMap_get_length( map, NULL );
+        ok ( r == E_INVALIDARG, "get_length should return E_INVALIDARG\n");
+
         r = IXMLDOMNamedNodeMap_get_length( map, &count );
         ok ( r == S_OK, "get_length wrong code\n");
         ok ( count == 1, "get_length != 1\n");