>From b9e70e9b832e9c7cd93e87a64f4cec5cac070133 Mon Sep 17 00:00:00 2001
From: Nikolay Sivov <nsivov@codeweavers.com>
Date: Mon, 23 Jan 2012 07:35:20 +0300
Subject: [PATCH 3/4] ::get_namespaceURI() doesn't reset out pointer on invalid index

---
 dlls/msxml3/schema.c       |    4 ++--
 dlls/msxml3/tests/schema.c |   12 +++++++-----
 2 files changed, 9 insertions(+), 7 deletions(-)

diff --git a/dlls/msxml3/schema.c b/dlls/msxml3/schema.c
index 9de3768..6913e35 100644
--- a/dlls/msxml3/schema.c
+++ b/dlls/msxml3/schema.c
@@ -1197,16 +1197,16 @@ static HRESULT WINAPI schema_cache_get_namespaceURI(IXMLDOMSchemaCollection2* if
                                                     LONG index, BSTR* len)
 {
     schema_cache* This = impl_from_IXMLDOMSchemaCollection2(iface);
-    cache_index_data data = {index,len};
+    cache_index_data data = {index, len};
     TRACE("(%p)->(%i %p)\n", This, index, len);
 
     if (!len)
         return E_POINTER;
-    *len = NULL;
 
     if (index >= xmlHashSize(This->cache))
         return E_FAIL;
 
+    *len = NULL;
     xmlHashScan(This->cache, cache_index, &data);
     return S_OK;
 }
diff --git a/dlls/msxml3/tests/schema.c b/dlls/msxml3/tests/schema.c
index 48e9d4d..c350267 100644
--- a/dlls/msxml3/tests/schema.c
+++ b/dlls/msxml3/tests/schema.c
@@ -853,11 +853,12 @@ static void test_length(void)
 static void test_collection_content(void)
 {
     IXMLDOMDocument2 *schema1, *schema2, *schema3, *schema4, *schema5;
+    BSTR content[5] = {NULL, NULL, NULL, NULL, NULL};
     IXMLDOMSchemaCollection *cache1, *cache2;
     VARIANT_BOOL b;
-    BSTR bstr;
-    BSTR content[5] = {NULL, NULL, NULL, NULL, NULL};
     LONG length;
+    HRESULT hr;
+    BSTR bstr;
     int i, j;
 
     schema1 = create_document_version(30, &IID_IXMLDOMDocument2);
@@ -935,10 +936,11 @@ static void test_collection_content(void)
         IXMLDOMDocument2_Release(schema5);
     }
 
-    bstr = NULL;
+    bstr = (void*)0xdeadbeef;
     /* error if index is out of range */
-    ole_expect(IXMLDOMSchemaCollection_get_namespaceURI(cache1, 3, &bstr), E_FAIL);
-    SysFreeString(bstr);
+    hr = IXMLDOMSchemaCollection_get_namespaceURI(cache1, 3, &bstr);
+    EXPECT_HR(hr, E_FAIL);
+    ok(bstr == (void*)0xdeadbeef, "got %p\n", bstr);
     /* error if return pointer is NULL */
     ole_expect(IXMLDOMSchemaCollection_get_namespaceURI(cache1, 0, NULL), E_POINTER);
     /* pointer is checked first */
-- 
1.5.6.5


