[PATCH 1/1] Handle passed BSTR argument as a WCHAR string in ::createProcessingInstruction()

[Nikolay Sivov]

---
 dlls/msxml3/domdoc.c       |   15 +++++++++++----
 dlls/msxml3/tests/domdoc.c |   23 +++++++++++++++++++++++
 2 files changed, 34 insertions(+), 4 deletions(-)

diff --git a/dlls/msxml3/domdoc.c b/dlls/msxml3/domdoc.c
index 2da243b..0ed1050 100644
--- a/dlls/msxml3/domdoc.c
+++ b/dlls/msxml3/domdoc.c
@@ -1599,15 +1599,22 @@ static HRESULT WINAPI domdoc_createProcessingInstruction(
     hr = IXMLDOMDocument3_createNode(iface, type, target, NULL, &node);
     if (hr == S_OK)
     {
-        VARIANT v_data;
         xmlnode *node_obj;
+        VARIANT v;
 
         /* this is to bypass check in ::put_data() that blocks "<?xml" PIs */
         node_obj = get_node_obj(node);
-        V_VT(&v_data)   = VT_BSTR;
-        V_BSTR(&v_data) = data;
+        V_VT(&v)   = VT_BSTR;
+        V_BSTR(&v) = SysAllocString(data);
 
-        hr = node_put_value(node_obj, &v_data);
+        if (!V_BSTR(&v))
+        {
+            IXMLDOMNode_Release(node);
+            return E_OUTOFMEMORY;
+        }
+
+        hr = node_put_value(node_obj, &v);
+        VariantClear(&v);
 
         IXMLDOMNode_QueryInterface(node, &IID_IXMLDOMProcessingInstruction, (void**)pi);
         IXMLDOMNode_Release(node);
diff --git a/dlls/msxml3/tests/domdoc.c b/dlls/msxml3/tests/domdoc.c
index 8821b25..80557f3 100644
--- a/dlls/msxml3/tests/domdoc.c
+++ b/dlls/msxml3/tests/domdoc.c
@@ -7125,6 +7125,28 @@ static void test_events(void)
     IXMLDOMDocument_Release(doc);
 }
 
+static void test_createProcessingInstruction(void)
+{
+    static const WCHAR bodyW[] = {'t','e','s','t',0};
+    IXMLDOMProcessingInstruction *pi;
+    IXMLDOMDocument *doc;
+    WCHAR buff[10];
+    HRESULT hr;
+
+    doc = create_document(&IID_IXMLDOMDocument);
+    if (!doc) return;
+
+    /* test for BSTR handling, pass broken BSTR */
+    memcpy(&buff[2], bodyW, sizeof(bodyW));
+    /* just a big length */
+    *(DWORD*)buff = 0xf0f0;
+    hr = IXMLDOMDocument_createProcessingInstruction(doc, _bstr_("test"), &buff[2], &pi);
+    ok(hr == S_OK, "got 0x%08x\n", hr);
+
+    IXMLDOMProcessingInstruction_Release(pi);
+    IXMLDOMDocument_Release(doc);
+}
+
 START_TEST(domdoc)
 {
     IXMLDOMDocument *doc;
@@ -7186,6 +7208,7 @@ START_TEST(domdoc)
     test_default_properties();
     test_selectSingleNode();
     test_events();
+    test_createProcessingInstruction();
 
     CoUninitialize();
 }
-- 
1.5.6.5


--------------010204050207040703060708--