Re: [Patch resend] msxml3: Fix crash when iterating through attributes with namespaces.

[Bernhard Übelacker]

Am 06.09.21 um 15:26 schrieb Nikolay Sivov:
> On 8/29/21 4:19 PM, Bernhard Übelacker wrote:
> > +static const char svg[] =
> > +    "<svg version=\"1.1\" xmlns=\"http://www.w3.org/2000/svg\" xmlns:xlink=\"http://www.w3.org/1999/xlink\"></svg>";
> > +
> > +static void test_prefixless_namespace(void)
> > +{
> > +    HRESULT hr;
> > +    IXMLDOMDocument *doc;
> > +    VARIANT_BOOL b;
> > +    BSTR str;
> > +    IXMLDOMNodeList *node_list;
> > +    LONG length;
> > +    IXMLDOMNode *node1;
> > +    IXMLDOMNode *node2;
> > +    IXMLDOMNamedNodeMap *node_map;
> > +    int found;
> > +
> > +    doc = create_document(&IID_IXMLDOMDocument);
> > +    EXPECT_REF(doc, 1);
> > +
> > +    hr = IXMLDOMDocument_loadXML(doc, _bstr_(svg), &b);
> > +    EXPECT_HR(hr, S_OK);
> > +
> > +    hr = IXMLDOMDocument_get_childNodes(doc, &node_list);
> > +    EXPECT_HR(hr, S_OK);
> > +
> > +    hr = IXMLDOMNodeList_get_item(node_list, 0, &node1);
> > +    EXPECT_HR(hr, S_OK);
> > +
> > +    node_map = (void *)0xdeadbeef;
> > +    hr = IXMLDOMNode_get_attributes(node1, &node_map);
> > +    EXPECT_HR(hr, S_OK);
> > +
> > +    length = 0xdeadbeef;
> > +    hr = IXMLDOMNamedNodeMap_get_length(node_map, &length);
> > +    EXPECT_HR(hr, S_OK);
> > +    ok(length == 3, "expected length=%d, got %d\n", 3, length);
> > +
> > +    found = 0;
> > +    for (int i = 0; i < length; i++)
> > +    {
> > +        hr = IXMLDOMNamedNodeMap_get_item(node_map, i, &node2);
> > +        EXPECT_HR(hr, S_OK);
> > +
> > +        str = (void *)0xdeadbeef;
> > +        hr = IXMLDOMNode_get_xml(node2, &str);
> > +        EXPECT_HR(hr, S_OK);
> > +        if (lstrcmpW(str, L"version=\"1.1\"") == 0) found++;
> > +        if (lstrcmpW(str, L"xmlns=\"http://www.w3.org/2000/svg\"") == 0) found++;
> > +        if (lstrcmpW(str, L"xmlns:xlink=\"http://www.w3.org/1999/xlink\"") == 0) found++;
> > +        SysFreeString(str);
> > +
> > +        IXMLDOMNode_Release(node2);
> > +    }
> > +    ok(found == 3, "expected to find %d elements, found %d\n", 3, found);
> > +
> > +    IXMLDOMNamedNodeMap_Release(node_map);
> > +    IXMLDOMNode_Release(node1);
> > +    IXMLDOMNodeList_Release(node_list);
> > +    IXMLDOMDocument_Release(doc);
> > +}
> > +
> >   START_TEST(domdoc)
> >   {
> >       HRESULT hr;
> > @@ -13745,6 +13806,7 @@ START_TEST(domdoc)
> >           test_mxnamespacemanager();
> >           test_mxnamespacemanager_override();
> >       }
> > +    test_prefixless_namespace();
>
> Hi, Bernhard. Sorry for the delay.
>
> Please use existing test function, like test_namespaces_as_attributes().

Hello Nikolay,
thanks for the review.
I tried to move the test into test_namespaces_as_attributes().

Unfortunately it looks like I hit there some differences between
the msxml40/msxml60 and msxml30 and below.

Also it showed that my proposed change is not
sufficient to succeed all tests, just makes it not crash.

This is a testbot run with testing just msxml30 and below,
that succeeds windows, but crashes with wine.

https://testbot.winehq.org/JobDetails.pl?Key=97653

Kind regards,
Bernhard