From: Damjan Jovanovic Subject: [PATCH] msxml3: return S_FALSE from IXMLDOMNamedNodeMap::nextNode() when there are no attributes Message-Id: Date: Sun, 20 Jun 2021 18:08:02 +0200 Currently Wine return S_FALSE when IXMLDOMNamedNodeMap::nextNode() has run out of attributes to return, but when an XML node has no attributes at all, it returns S_OK despite setting the nextNode output parameter to NULL, causing the caller to crash when it accesses this pointer. Return S_FALSE in this case instead. Wine-Bug: https://bugs.winehq.org/show_bug.cgi?id=50603 Signed-off-by: Damjan Jovanovic --- dlls/msxml3/element.c | 2 ++ dlls/msxml3/tests/domdoc.c | 25 +++++++++++++++++++++++++ 2 files changed, 27 insertions(+) diff --git a/dlls/msxml3/element.c b/dlls/msxml3/element.c index 5891653a76f..1a523798328 100644 --- a/dlls/msxml3/element.c +++ b/dlls/msxml3/element.c @@ -1890,6 +1890,8 @@ static HRESULT domelem_next_node(const xmlNodePtr node, LONG *iter, IXMLDOMNode *nextNode = NULL; curr = node->properties; + if (curr == NULL) + return S_FALSE; for (i = 0; i < *iter; i++) { if (curr->next == NULL) diff --git a/dlls/msxml3/tests/domdoc.c b/dlls/msxml3/tests/domdoc.c index b1f172e3faa..df30104a156 100644 --- a/dlls/msxml3/tests/domdoc.c +++ b/dlls/msxml3/tests/domdoc.c @@ -2205,6 +2205,8 @@ static void test_domnode( void ) if (element) { + IXMLDOMNamedNodeMap *attributes; + owner = NULL; r = IXMLDOMElement_get_ownerDocument( element, &owner ); ok( r == S_OK, "get_ownerDocument return code\n"); @@ -2283,6 +2285,29 @@ static void test_domnode( void ) ok( map != NULL, "should be attributes\n"); EXPECT_CHILDREN(element); + + r = IXMLDOMElement_get_childNodes( element, &list ); + ok( r == S_OK, "Expected S_OK, ret %08x\n", r ); + r = IXMLDOMNodeList_nextNode( list, &node ); /* */ + ok( r == S_OK, "Expected S_OK, ret %08x\n", r ); + IXMLDOMNode_Release( node ); + r = IXMLDOMNodeList_nextNode( list, &node ); /* */ + ok( r == S_OK, "Expected S_OK, ret %08x\n", r ); + IXMLDOMNode_Release( node ); + r = IXMLDOMNodeList_nextNode( list, &node ); /* */ + ok( r == S_OK, "Expected S_OK, ret %08x\n", r ); + r = IXMLDOMNode_get_attributes( node, &attributes ); + ok( r == S_OK, "Expected S_OK, ret %08x\n", r ); + next = (IXMLDOMNode*)0xdeadbeef; + r = IXMLDOMNamedNodeMap_nextNode( attributes, &next ); + ok( r == S_FALSE, "Expected S_FALSE, ret %08x\n", r ); + ok( next == NULL, "Expected NULL, ret %p\n", next ); + IXMLDOMNamedNodeMap_Release( attributes ); + IXMLDOMNode_Release( node ); + node = NULL; + next = NULL; + IXMLDOMNodeList_Release( list ); + list = NULL; } else ok( FALSE, "no element\n");