[PATCH v2 0/3] MR4073: msxml3: Stop possible typelib out of bounds access (Coverity)

[Alistair Leslie-Hughes (＠alesliehughes)]

typelib has an array size of 2 (eg LibXml_Last), so a lookup
of IID_NULL will result in a lookup of the third index.

--
  v2: msxml3: Free IBindCtx on error paths (Coverity)
      msxml3: Move tid_NULL out of possible enum values.
      msxml3: Dont call qsort if we have no data (Coverity).

https://gitlab.winehq.org/wine/wine/-/merge_requests/4073

[PATCH v2 1/3] msxml3: Dont call qsort if we have no data (Coverity).

[Alistair Leslie-Hughes]

From: Alistair Leslie-Hughes

---
 dlls/msxml3/dispex.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/dlls/msxml3/dispex.c b/dlls/msxml3/dispex.c
index cd7c2820133..6212fc2976c 100644
--- a/dlls/msxml3/dispex.c
+++ b/dlls/msxml3/dispex.c
@@ -294,9 +294,9 @@ static dispex_data_t *preprocess_dispex_data(DispatchEx *This)
         data->funcs = heap_realloc(data->funcs, data->func_cnt * sizeof(func_info_t));
     }

-    qsort(data->funcs, data->func_cnt, sizeof(func_info_t), dispid_cmp);
-
     if(data->funcs) {
+        qsort(data->funcs, data->func_cnt, sizeof(func_info_t), dispid_cmp);
+
         data->name_table = heap_alloc(data->func_cnt * sizeof(func_info_t*));
         for(i=0; i < data->func_cnt; i++)
             data->name_table[i] = data->funcs+i;

[PATCH v2 2/3] msxml3: Move tid_NULL out of possible enum values.

[Alistair Leslie-Hughes]

From: Alistair Leslie-Hughes

This was reported as a out of bounds access (Coverity), which is possible
if the tid_NULL was every passed in.
---
 dlls/msxml3/dispex.c       | 1 -
 dlls/msxml3/msxml_dispex.h | 3 ++-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/dlls/msxml3/dispex.c b/dlls/msxml3/dispex.c
index 6212fc2976c..1289fb4ec91 100644
--- a/dlls/msxml3/dispex.c
+++ b/dlls/msxml3/dispex.c
@@ -82,7 +82,6 @@ static lib_id_t lib_ids[] = {
 };

static tid_id_t tid_ids[] = {
-    { &IID_NULL, LibXml_Last },
     { &IID_IXMLDOMAttribute, LibXml2 },
     { &IID_IXMLDOMCDATASection, LibXml2 },
     { &IID_IXMLDOMComment, LibXml2 },
diff --git a/dlls/msxml3/msxml_dispex.h b/dlls/msxml3/msxml_dispex.h
index 31d0cdfae7d..28d6486568d 100644
--- a/dlls/msxml3/msxml_dispex.h
+++ b/dlls/msxml3/msxml_dispex.h
@@ -34,9 +34,10 @@ typedef enum
     MSXML6        = 60
 } MSXML_VERSION;

+#define NULL_tid -1
+
 typedef enum tid_t
 {
-    NULL_tid,
     IXMLDOMAttribute_tid,
     IXMLDOMCDATASection_tid,
     IXMLDOMComment_tid,

[PATCH v2 3/3] msxml3: Free IBindCtx on error paths (Coverity)

[Alistair Leslie-Hughes]

From: Alistair Leslie-Hughes

---
 dlls/msxml3/httprequest.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/dlls/msxml3/httprequest.c b/dlls/msxml3/httprequest.c
index 459466a1234..953f49f1eee 100644
--- a/dlls/msxml3/httprequest.c
+++ b/dlls/msxml3/httprequest.c
@@ -736,6 +736,7 @@ static HRESULT BindStatusCallback_create(httprequest* This, BindStatusCallback *
             if (!(ptr = heap_alloc(size)))
             {
                 heap_free(bsc);
+                IBindCtx_Release(pbc);
                 return E_OUTOFMEMORY;
             }
             WideCharToMultiByte(cp, 0, str, len, ptr, size, NULL, NULL);
@@ -754,6 +755,7 @@ static HRESULT BindStatusCallback_create(httprequest* This, BindStatusCallback *
             {
                 SafeArrayUnaccessData(sa);
                 heap_free(bsc);
+                IBindCtx_Release(pbc);
                 return hr;
             }
             size++;
@@ -781,6 +783,7 @@ static HRESULT BindStatusCallback_create(httprequest* This, BindStatusCallback *
                     SafeArrayUnaccessData(sa);

heap_free(bsc);
+                IBindCtx_Release(pbc);
                 return E_OUTOFMEMORY;
             }