From 97b3a4dcfcdf091e7b5d00d65a3239efc17c7aae Mon Sep 17 00:00:00 2001 From: Jefferson Carpenter Date: Wed, 19 May 2021 06:02:56 +0000 Subject: [PATCH] msxml3: Null check new child in insertBefore. Signed-off-by: Jefferson Carpenter --- v2: Add todo_wine on new failing tests. --- dlls/msxml3/domdoc.c | 2 ++ dlls/msxml3/element.c | 2 ++ dlls/msxml3/tests/domdoc.c | 29 +++++++++++++++++++++++++++++ 3 files changed, 33 insertions(+) diff --git a/dlls/msxml3/domdoc.c b/dlls/msxml3/domdoc.c index c67e570a8ea..d2110f74a1b 100644 --- a/dlls/msxml3/domdoc.c +++ b/dlls/msxml3/domdoc.c @@ -1210,6 +1210,8 @@ static HRESULT WINAPI domdoc_insertBefore( TRACE("(%p)->(%p %s %p)\n", This, newChild, debugstr_variant(&refChild), outNewChild); + if (!newChild) return E_INVALIDARG; + hr = IXMLDOMNode_get_nodeType(newChild, &type); if (hr != S_OK) return hr; diff --git a/dlls/msxml3/element.c b/dlls/msxml3/element.c index 05255508d4e..5891653a76f 100644 --- a/dlls/msxml3/element.c +++ b/dlls/msxml3/element.c @@ -309,6 +309,8 @@ static HRESULT WINAPI domelem_insertBefore( TRACE("(%p)->(%p %s %p)\n", This, newNode, debugstr_variant(&refChild), old_node); + if (!newNode) return E_INVALIDARG; + hr = IXMLDOMNode_get_nodeType(newNode, &type); if (hr != S_OK) return hr; diff --git a/dlls/msxml3/tests/domdoc.c b/dlls/msxml3/tests/domdoc.c index 3dcfdb8fd39..d6f36ccf0d3 100644 --- a/dlls/msxml3/tests/domdoc.c +++ b/dlls/msxml3/tests/domdoc.c @@ -9240,6 +9240,13 @@ static void test_insertBefore(void) doc = create_document(&IID_IXMLDOMDocument); doc3 = create_document(&IID_IXMLDOMDocument); + /* NULL to document */ + V_VT(&v) = VT_NULL; + node = (void*)0xdeadbeef; + hr = IXMLDOMDocument_insertBefore(doc, (IXMLDOMNode*)NULL, v, &node); + ok(hr == E_INVALIDARG, "got 0x%08x\n", hr); + ok(node == (void*)0xdeadbeef, "got %p\n", node); + /* document to document */ V_VT(&v) = VT_NULL; node = (void*)0xdeadbeef; @@ -9281,6 +9288,13 @@ static void test_insertBefore(void) EXPECT_NO_CHILDREN(cdata); + /* NULL to cdata */ + V_VT(&v) = VT_NULL; + node = (void*)0xdeadbeef; + hr = IXMLDOMNode_insertBefore(cdata, (IXMLDOMNode*)NULL, v, &node); + todo_wine ok(hr == E_INVALIDARG, "got 0x%08x\n", hr); + todo_wine ok(node == (void*)0xdeadbeef, "got %p\n", node); + /* attribute to cdata */ V_VT(&v) = VT_NULL; node = (void*)0xdeadbeef; @@ -9304,6 +9318,13 @@ static void test_insertBefore(void) IXMLDOMNode_Release(cdata); IXMLDOMDocument_Release(doc3); + /* NULL to attribute */ + V_VT(&v) = VT_NULL; + node = (void*)0xdeadbeef; + hr = IXMLDOMAttribute_insertBefore(attr, (IXMLDOMNode*)NULL, v, &node); + ok(hr == E_INVALIDARG, "got 0x%08x\n", hr); + ok(node == (void*)0xdeadbeef, "got %p\n", node); + /* attribute to attribute */ V_VT(&v) = VT_I4; V_I4(&v) = NODE_ATTRIBUTE; @@ -9409,12 +9430,20 @@ static void test_insertBefore(void) todo_wine EXPECT_REF(elem2, 2); + /* NULL to element */ + V_VT(&v) = VT_NULL; + node = (void*)0xdeadbeef; + hr = IXMLDOMElement_insertBefore(elem1, (IXMLDOMNode*)NULL, v, &node); + ok(hr == E_INVALIDARG, "got 0x%08x\n", hr); + ok(node == (void*)0xdeadbeef, "got %p\n", node); + /* document to element */ V_VT(&v) = VT_DISPATCH; V_DISPATCH(&v) = NULL; hr = IXMLDOMElement_insertBefore(elem1, (IXMLDOMNode*)doc, v, NULL); ok(hr == E_FAIL, "got 0x%08x\n", hr); + /* element to element */ V_VT(&v) = VT_DISPATCH; V_DISPATCH(&v) = NULL; node = NULL; -- 2.26.2