From dc890adf3fdf67f72782d2d29d39dfe4bbbec947 Mon Sep 17 00:00:00 2001 From: Jefferson Carpenter Date: Wed, 19 May 2021 06:02:56 +0000 Subject: [PATCH] msxml3: Null check new child in insertBefore. Signed-off-by: Jefferson Carpenter --- dlls/msxml3/domdoc.c | 2 ++ dlls/msxml3/element.c | 2 ++ dlls/msxml3/tests/domdoc.c | 29 +++++++++++++++++++++++++++++ 3 files changed, 33 insertions(+) diff --git a/dlls/msxml3/domdoc.c b/dlls/msxml3/domdoc.c index 80c32e9ba99..959d56033d8 100644 --- a/dlls/msxml3/domdoc.c +++ b/dlls/msxml3/domdoc.c @@ -1175,6 +1175,8 @@ static HRESULT WINAPI domdoc_insertBefore( TRACE("(%p)->(%p %s %p)\n", This, newChild, debugstr_variant(&refChild), outNewChild); + if (!newChild) return E_INVALIDARG; + hr = IXMLDOMNode_get_nodeType(newChild, &type); if (hr != S_OK) return hr; diff --git a/dlls/msxml3/element.c b/dlls/msxml3/element.c index 05255508d4e..5891653a76f 100644 --- a/dlls/msxml3/element.c +++ b/dlls/msxml3/element.c @@ -309,6 +309,8 @@ static HRESULT WINAPI domelem_insertBefore( TRACE("(%p)->(%p %s %p)\n", This, newNode, debugstr_variant(&refChild), old_node); + if (!newNode) return E_INVALIDARG; + hr = IXMLDOMNode_get_nodeType(newNode, &type); if (hr != S_OK) return hr; diff --git a/dlls/msxml3/tests/domdoc.c b/dlls/msxml3/tests/domdoc.c index 5bc2fe1d5c3..0b61721d107 100644 --- a/dlls/msxml3/tests/domdoc.c +++ b/dlls/msxml3/tests/domdoc.c @@ -9155,6 +9155,13 @@ static void test_insertBefore(void) doc = create_document(&IID_IXMLDOMDocument); doc3 = create_document(&IID_IXMLDOMDocument); + /* NULL to document */ + V_VT(&v) = VT_NULL; + node = (void*)0xdeadbeef; + hr = IXMLDOMDocument_insertBefore(doc, (IXMLDOMNode*)NULL, v, &node); + ok(hr == E_INVALIDARG, "got 0x%08x\n", hr); + ok(node == (void*)0xdeadbeef, "got %p\n", node); + /* document to document */ V_VT(&v) = VT_NULL; node = (void*)0xdeadbeef; @@ -9196,6 +9203,13 @@ static void test_insertBefore(void) EXPECT_NO_CHILDREN(cdata); + /* NULL to cdata */ + V_VT(&v) = VT_NULL; + node = (void*)0xdeadbeef; + hr = IXMLDOMNode_insertBefore(cdata, (IXMLDOMNode*)NULL, v, &node); + ok(hr == E_INVALIDARG, "got 0x%08x\n", hr); + ok(node == (void*)0xdeadbeef, "got %p\n", node); + /* attribute to cdata */ V_VT(&v) = VT_NULL; node = (void*)0xdeadbeef; @@ -9219,6 +9233,13 @@ static void test_insertBefore(void) IXMLDOMNode_Release(cdata); IXMLDOMDocument_Release(doc3); + /* NULL to attribute */ + V_VT(&v) = VT_NULL; + node = (void*)0xdeadbeef; + hr = IXMLDOMAttribute_insertBefore(attr, (IXMLDOMNode*)NULL, v, &node); + ok(hr == E_INVALIDARG, "got 0x%08x\n", hr); + ok(node == (void*)0xdeadbeef, "got %p\n", node); + /* attribute to attribute */ V_VT(&v) = VT_I4; V_I4(&v) = NODE_ATTRIBUTE; @@ -9324,12 +9345,20 @@ static void test_insertBefore(void) todo_wine EXPECT_REF(elem2, 2); + /* NULL to element */ + V_VT(&v) = VT_NULL; + node = (void*)0xdeadbeef; + hr = IXMLDOMElement_insertBefore(elem1, (IXMLDOMNode*)NULL, v, &node); + ok(hr == E_INVALIDARG, "got 0x%08x\n", hr); + ok(node == (void*)0xdeadbeef, "got %p\n", node); + /* document to element */ V_VT(&v) = VT_DISPATCH; V_DISPATCH(&v) = NULL; hr = IXMLDOMElement_insertBefore(elem1, (IXMLDOMNode*)doc, v, NULL); ok(hr == E_FAIL, "got 0x%08x\n", hr); + /* element to element */ V_VT(&v) = VT_DISPATCH; V_DISPATCH(&v) = NULL; node = NULL; -- 2.26.2