>From a182f0ada14ab263321ee471fc2e369971e14a5a Mon Sep 17 00:00:00 2001
From: Nikolay Sivov <nsivov@codeweavers.com>
Date: Sun, 29 Jan 2012 12:24:36 +0300
Subject: [PATCH 4/7] Check for unsafe cast in addCollection()

---
 dlls/msxml3/schema.c |   28 ++++++++++++++++++++++++----
 1 files changed, 24 insertions(+), 4 deletions(-)

diff --git a/dlls/msxml3/schema.c b/dlls/msxml3/schema.c
index 253f901..e6af8b2 100644
--- a/dlls/msxml3/schema.c
+++ b/dlls/msxml3/schema.c
@@ -786,11 +786,23 @@ static LONG cache_entry_release(cache_entry* entry)
     return ref;
 }
 
+static const struct IXMLDOMSchemaCollection2Vtbl XMLDOMSchemaCollection2Vtbl;
+
 static inline schema_cache* impl_from_IXMLDOMSchemaCollection2(IXMLDOMSchemaCollection2* iface)
 {
     return CONTAINING_RECORD(iface, schema_cache, IXMLDOMSchemaCollection2_iface);
 }
 
+static inline schema_cache* impl_from_IXMLDOMSchemaCollection(IXMLDOMSchemaCollection* iface)
+{
+    return CONTAINING_RECORD(iface, schema_cache, IXMLDOMSchemaCollection2_iface);
+}
+
+static inline schema_cache* unsafe_impl_from_IXMLDOMSchemaCollection(IXMLDOMSchemaCollection *iface)
+{
+    return iface->lpVtbl == (void*)&XMLDOMSchemaCollection2Vtbl ? impl_from_IXMLDOMSchemaCollection(iface) : NULL;
+}
+
 static inline CacheEntryType cache_type_from_xmlDocPtr(xmlDocPtr schema)
 {
     xmlNodePtr root = NULL;
@@ -1292,15 +1304,23 @@ static void cache_copy(void* data, void* dest, xmlChar* name)
 }
 
 static HRESULT WINAPI schema_cache_addCollection(IXMLDOMSchemaCollection2* iface,
-                                                 IXMLDOMSchemaCollection* otherCollection)
+                                                 IXMLDOMSchemaCollection* collection)
 {
     schema_cache* This = impl_from_IXMLDOMSchemaCollection2(iface);
-    schema_cache* That = impl_from_IXMLDOMSchemaCollection2((IXMLDOMSchemaCollection2*)otherCollection);
-    TRACE("(%p)->(%p)\n", This, That);
+    schema_cache* That;
+
+    TRACE("(%p)->(%p)\n", This, collection);
 
-    if (!otherCollection)
+    if (!collection)
         return E_POINTER;
 
+    That = unsafe_impl_from_IXMLDOMSchemaCollection(collection);
+    if (!That)
+    {
+        ERR("external collection implementation\n");
+        return E_FAIL;
+    }
+
     /* TODO: detect errors while copying & return E_FAIL */
     xmlHashScan(That->cache, cache_copy, This);
 
-- 
1.5.6.5

