Nikolay Sivov : msxml3: Check for unsafe cast in addCollection().

[Alexandre Julliard]

Module: wine
Branch: master
Commit: 8889b66ffe88830da2e4f2fadaad89fecf43b262
URL:    http://source.winehq.org/git/wine.git/?a=commit;h=8889b66ffe88830da2e4f2fadaad89fecf43b262

Author: Nikolay Sivov <nsivov at codeweavers.com>
Date:   Thu Mar  8 12:04:41 2012 +0300

msxml3: Check for unsafe cast in addCollection().

---

 dlls/msxml3/schema.c |   28 ++++++++++++++++++++++++----
 1 files changed, 24 insertions(+), 4 deletions(-)

diff --git a/dlls/msxml3/schema.c b/dlls/msxml3/schema.c
index 253f901..e6af8b2 100644
--- a/dlls/msxml3/schema.c
+++ b/dlls/msxml3/schema.c
@@ -786,11 +786,23 @@ static LONG cache_entry_release(cache_entry* entry)
     return ref;
 }
 
+static const struct IXMLDOMSchemaCollection2Vtbl XMLDOMSchemaCollection2Vtbl;
+
 static inline schema_cache* impl_from_IXMLDOMSchemaCollection2(IXMLDOMSchemaCollection2* iface)
 {
     return CONTAINING_RECORD(iface, schema_cache, IXMLDOMSchemaCollection2_iface);
 }
 
+static inline schema_cache* impl_from_IXMLDOMSchemaCollection(IXMLDOMSchemaCollection* iface)
+{
+    return CONTAINING_RECORD(iface, schema_cache, IXMLDOMSchemaCollection2_iface);
+}
+
+static inline schema_cache* unsafe_impl_from_IXMLDOMSchemaCollection(IXMLDOMSchemaCollection *iface)
+{
+    return iface->lpVtbl == (void*)&XMLDOMSchemaCollection2Vtbl ? impl_from_IXMLDOMSchemaCollection(iface) : NULL;
+}
+
 static inline CacheEntryType cache_type_from_xmlDocPtr(xmlDocPtr schema)
 {
     xmlNodePtr root = NULL;
@@ -1292,15 +1304,23 @@ static void cache_copy(void* data, void* dest, xmlChar* name)
 }
 
 static HRESULT WINAPI schema_cache_addCollection(IXMLDOMSchemaCollection2* iface,
-                                                 IXMLDOMSchemaCollection* otherCollection)
+                                                 IXMLDOMSchemaCollection* collection)
 {
     schema_cache* This = impl_from_IXMLDOMSchemaCollection2(iface);
-    schema_cache* That = impl_from_IXMLDOMSchemaCollection2((IXMLDOMSchemaCollection2*)otherCollection);
-    TRACE("(%p)->(%p)\n", This, That);
+    schema_cache* That;
+
+    TRACE("(%p)->(%p)\n", This, collection);
 
-    if (!otherCollection)
+    if (!collection)
         return E_POINTER;
 
+    That = unsafe_impl_from_IXMLDOMSchemaCollection(collection);
+    if (!That)
+    {
+        ERR("external collection implementation\n");
+        return E_FAIL;
+    }
+
     /* TODO: detect errors while copying & return E_FAIL */
     xmlHashScan(That->cache, cache_copy, This);