Module: wine
Branch: master
Commit: 06cd8d3d2eb09ffb19f26e95360c3ddcc4caf46d
URL: https://source.winehq.org/git/wine.git/?a=commit;h=06cd8d3d2eb09ffb19f26e95…
Author: Damjan Jovanovic <damjan.jov(a)gmail.com>
Date: Sun Jun 20 18:08:02 2021 +0200
msxml3: Return S_FALSE from IXMLDOMNamedNodeMap::nextNode() when there are no attributes.
Currently Wine return S_FALSE when IXMLDOMNamedNodeMap::nextNode()
has run out of attributes to return, but when an XML node has no
attributes at all, it returns S_OK despite setting the nextNode
output parameter to NULL, causing the caller to crash when it
accesses this pointer. Return S_FALSE in this case instead.
Wine-Bug: https://bugs.winehq.org/show_bug.cgi?id=50603
Signed-off-by: Damjan Jovanovic <damjan.jov(a)gmail.com>
Signed-off-by: Nikolay Sivov <nsivov(a)codeweavers.com>
Signed-off-by: Alexandre Julliard <julliard(a)winehq.org>
---
dlls/msxml3/element.c | 2 ++
dlls/msxml3/tests/domdoc.c | 25 +++++++++++++++++++++++++
2 files changed, 27 insertions(+)
diff --git a/dlls/msxml3/element.c b/dlls/msxml3/element.c
index 5891653a76f..1a523798328 100644
--- a/dlls/msxml3/element.c
+++ b/dlls/msxml3/element.c
@@ -1890,6 +1890,8 @@ static HRESULT domelem_next_node(const xmlNodePtr node, LONG *iter, IXMLDOMNode
*nextNode = NULL;
curr = node->properties;
+ if (curr == NULL)
+ return S_FALSE;
for (i = 0; i < *iter; i++) {
if (curr->next == NULL)
diff --git a/dlls/msxml3/tests/domdoc.c b/dlls/msxml3/tests/domdoc.c
index b1f172e3faa..df30104a156 100644
--- a/dlls/msxml3/tests/domdoc.c
+++ b/dlls/msxml3/tests/domdoc.c
@@ -2205,6 +2205,8 @@ static void test_domnode( void )
if (element)
{
+ IXMLDOMNamedNodeMap *attributes;
+
owner = NULL;
r = IXMLDOMElement_get_ownerDocument( element, &owner );
ok( r == S_OK, "get_ownerDocument return code\n");
@@ -2283,6 +2285,29 @@ static void test_domnode( void )
ok( map != NULL, "should be attributes\n");
EXPECT_CHILDREN(element);
+
+ r = IXMLDOMElement_get_childNodes( element, &list );
+ ok( r == S_OK, "Expected S_OK, ret %08x\n", r );
+ r = IXMLDOMNodeList_nextNode( list, &node ); /* <bs> */
+ ok( r == S_OK, "Expected S_OK, ret %08x\n", r );
+ IXMLDOMNode_Release( node );
+ r = IXMLDOMNodeList_nextNode( list, &node ); /* <pr> */
+ ok( r == S_OK, "Expected S_OK, ret %08x\n", r );
+ IXMLDOMNode_Release( node );
+ r = IXMLDOMNodeList_nextNode( list, &node ); /* <empty> */
+ ok( r == S_OK, "Expected S_OK, ret %08x\n", r );
+ r = IXMLDOMNode_get_attributes( node, &attributes );
+ ok( r == S_OK, "Expected S_OK, ret %08x\n", r );
+ next = (IXMLDOMNode*)0xdeadbeef;
+ r = IXMLDOMNamedNodeMap_nextNode( attributes, &next );
+ ok( r == S_FALSE, "Expected S_FALSE, ret %08x\n", r );
+ ok( next == NULL, "Expected NULL, ret %p\n", next );
+ IXMLDOMNamedNodeMap_Release( attributes );
+ IXMLDOMNode_Release( node );
+ node = NULL;
+ next = NULL;
+ IXMLDOMNodeList_Release( list );
+ list = NULL;
}
else
ok( FALSE, "no element\n");