From bbbf009665584a4793ff166fb50064eab51cd25b Mon Sep 17 00:00:00 2001 From: Jefferson Carpenter Date: Thu, 27 May 2021 12:36:46 +0000 Subject: [PATCH 1/2] msxml3: Null check newChild in DOMDocument insertBefore. Signed-off-by: Jefferson Carpenter --- dlls/msxml3/domdoc.c | 2 ++ dlls/msxml3/tests/domdoc.c | 7 +++++++ 2 files changed, 9 insertions(+) diff --git a/dlls/msxml3/domdoc.c b/dlls/msxml3/domdoc.c index c67e570a8ea..d2110f74a1b 100644 --- a/dlls/msxml3/domdoc.c +++ b/dlls/msxml3/domdoc.c @@ -1210,6 +1210,8 @@ static HRESULT WINAPI domdoc_insertBefore( TRACE("(%p)->(%p %s %p)\n", This, newChild, debugstr_variant(&refChild), outNewChild); + if (!newChild) return E_INVALIDARG; + hr = IXMLDOMNode_get_nodeType(newChild, &type); if (hr != S_OK) return hr; diff --git a/dlls/msxml3/tests/domdoc.c b/dlls/msxml3/tests/domdoc.c index 3dcfdb8fd39..0cc4d9c3c24 100644 --- a/dlls/msxml3/tests/domdoc.c +++ b/dlls/msxml3/tests/domdoc.c @@ -9240,6 +9240,13 @@ static void test_insertBefore(void) doc = create_document(&IID_IXMLDOMDocument); doc3 = create_document(&IID_IXMLDOMDocument); + /* NULL to document */ + V_VT(&v) = VT_NULL; + node = (void*)0xdeadbeef; + hr = IXMLDOMDocument_insertBefore(doc, NULL, v, &node); + ok(hr == E_INVALIDARG, "got 0x%08x\n", hr); + ok(node == (void*)0xdeadbeef, "got %p\n", node); + /* document to document */ V_VT(&v) = VT_NULL; node = (void*)0xdeadbeef; -- 2.26.2