Nikolay Sivov : msxml3: Don't crash on null pointer when doing ::Next() on a last child.

[Alexandre Julliard]

Module: wine
Branch: master
Commit: 473c5c4cc02b376ae561368cd5623372fe4223b5
URL:    http://source.winehq.org/git/wine.git/?a=commit;h=473c5c4cc02b376ae561368cd5623372fe4223b5

Author: Nikolay Sivov <nsivov at codeweavers.com>
Date:   Mon Jun 21 02:46:23 2010 +0400

msxml3: Don't crash on null pointer when doing ::Next() on a last child.

---

 dlls/msxml3/tests/xmlelem.c |   10 ++++++++++
 dlls/msxml3/xmlelem.c       |   17 ++++++++++++-----
 2 files changed, 22 insertions(+), 5 deletions(-)

diff --git a/dlls/msxml3/tests/xmlelem.c b/dlls/msxml3/tests/xmlelem.c
index 3304d5a..f38d515 100644
--- a/dlls/msxml3/tests/xmlelem.c
+++ b/dlls/msxml3/tests/xmlelem.c
@@ -357,6 +357,16 @@ static void test_xmlelem_collection(void)
     ok(V_VT(&var) == VT_DISPATCH, "Expected VT_DISPATCH, got %d\n", V_VT(&var));
     ok(num_vars == 1, "Expected 1, got %d\n", num_vars);
 
+    /* try advance further, no children left */
+    hr = IEnumVARIANT_Next(enumVar, 1, &var, &num_vars);
+    ok(hr == S_FALSE, "Expected S_FALSE, got %08x\n", hr);
+    ok(V_VT(&var) == 0, "Expected 0, got %d\n", V_VT(&var));
+    ok(num_vars == 0, "Expected 0, got %d\n", num_vars);
+
+    hr = IEnumVARIANT_Next(enumVar, 1, &var, NULL);
+    ok(hr == S_FALSE, "Expected S_FALSE, got %08x\n", hr);
+    ok(V_VT(&var) == 0, "Expected 0, got %d\n", V_VT(&var));
+
     hr = IUnknown_QueryInterface(V_DISPATCH(&var), &IID_IXMLElement, (LPVOID *)&child);
     ok(hr == S_OK, "Expected S_OK, got %08x\n", hr);
     ok(child != NULL, "Expected non-NULL child\n");
diff --git a/dlls/msxml3/xmlelem.c b/dlls/msxml3/xmlelem.c
index 7a4faa3..c067179 100644
--- a/dlls/msxml3/xmlelem.c
+++ b/dlls/msxml3/xmlelem.c
@@ -723,21 +723,28 @@ static ULONG WINAPI xmlelem_collection_IEnumVARIANT_Release(
 }
 
 static HRESULT WINAPI xmlelem_collection_IEnumVARIANT_Next(
-    IEnumVARIANT *iface, ULONG celt, VARIANT *rgVar, ULONG *pCeltFetched)
+    IEnumVARIANT *iface, ULONG celt, VARIANT *rgVar, ULONG *fetched)
 {
     xmlelem_collection *This = impl_from_IEnumVARIANT(iface);
     xmlNodePtr ptr = This->current;
 
-    TRACE("(%p, %d, %p, %p)\n", iface, celt, rgVar, pCeltFetched);
+    TRACE("(%p, %d, %p, %p)\n", iface, celt, rgVar, fetched);
 
     if (!rgVar)
         return E_INVALIDARG;
 
     /* FIXME: handle celt */
-    if (pCeltFetched)
-        *pCeltFetched = 1;
+    if (fetched)
+        *fetched = 1;
 
-    This->current = This->current->next;
+    if (This->current)
+        This->current = This->current->next;
+    else
+    {
+        V_VT(rgVar) = VT_EMPTY;
+        if (fetched) *fetched = 0;
+        return S_FALSE;
+    }
 
     V_VT(rgVar) = VT_DISPATCH;
     return XMLElement_create((IUnknown *)iface, ptr, (LPVOID *)&V_DISPATCH(rgVar), FALSE);