[PATCH 1/5] msxml3: When writing to stream \0 terminate output.

[Dmitry Timoshkov]

This fixes heap corruption when running the domdoc tests.

Signed-off-by: Dmitry Timoshkov 
---
 dlls/msxml3/domdoc.c       | 12 +++++++++++-
 dlls/msxml3/tests/domdoc.c |  3 ---
 2 files changed, 11 insertions(+), 4 deletions(-)

diff --git a/dlls/msxml3/domdoc.c b/dlls/msxml3/domdoc.c
index cf4f0433218..cb34632c203 100644
--- a/dlls/msxml3/domdoc.c
+++ b/dlls/msxml3/domdoc.c
@@ -2524,8 +2524,18 @@ static int XMLCALL domdoc_stream_save_writecallback(void *ctx, const char *buffe

static int XMLCALL domdoc_stream_save_closecallback(void *ctx)
 {
+    ULONG written;
+    HRESULT hr;
+
+    hr = IStream_Write((IStream*)ctx, "\0", 1, &written);
+    if (hr != S_OK)
+    {
+        WARN("stream write error: 0x%08x\n", hr);
+        hr = -1;
+    }
+
     IStream_Release((IStream*)ctx);
-    return 0;
+    return hr;
 }

static HRESULT WINAPI domdoc_save(
diff --git a/dlls/msxml3/tests/domdoc.c b/dlls/msxml3/tests/domdoc.c
index 6f8e2b44ed3..63fc57527b4 100644
--- a/dlls/msxml3/tests/domdoc.c
+++ b/dlls/msxml3/tests/domdoc.c
@@ -8586,7 +8586,6 @@ todo_wine
     hr = GetHGlobalFromStream(stream, &global);
     ok(hr == S_OK, "got 0x%08x\n", hr);
     p = GlobalLock(global);
-    p[GlobalSize(global)] = 0;
     ok(!strcmp(p, xml2) || !strcmp(p, xml2_wine), "got %s\n", wine_dbgstr_a(p));
     GlobalUnlock(global);

@@ -8609,7 +8608,6 @@ todo_wine
     hr = GetHGlobalFromStream(stream, &global);
     ok(hr == S_OK, "got 0x%08x\n", hr);
     p = GlobalLock(global);
-    p[GlobalSize(global)] = 0;
     ok(!strcmp(p, xml2) || !strcmp(p, xml2_wine), "got %s\n", wine_dbgstr_a(p));
     GlobalUnlock(global);

@@ -8631,7 +8629,6 @@ todo_wine
     ok(hr == S_OK, "got 0x%08x\n", hr);

p = GlobalLock(global);
-    p[GlobalSize(global)] = 0;
     ok(!strcmp(p, xml3) || !strcmp(p, xml3_wine), "got %s\n", wine_dbgstr_a(p));
     GlobalUnlock(global);