Damjan Jovanovic : msxml3: Return S_FALSE from IXMLDOMNamedNodeMap::nextNode() when there are no attributes.

[Alexandre Julliard]

Module: wine
Branch: oldstable
Commit: 66fe6841b8dc6ae998cdd5409f50975504dc3b98
URL:    https://source.winehq.org/git/wine.git/?a=commit;h=66fe6841b8dc6ae998cdd5409f50975504dc3b98

Author: Damjan Jovanovic <damjan.jov at gmail.com>
Date:   Sun Jun 20 18:08:02 2021 +0200

msxml3: Return S_FALSE from IXMLDOMNamedNodeMap::nextNode() when there are no attributes.

Currently Wine return S_FALSE when IXMLDOMNamedNodeMap::nextNode()
has run out of attributes to return, but when an XML node has no
attributes at all, it returns S_OK despite setting the nextNode
output parameter to NULL, causing the caller to crash when it
accesses this pointer. Return S_FALSE in this case instead.

Wine-Bug: https://bugs.winehq.org/show_bug.cgi?id=50603
Signed-off-by: Damjan Jovanovic <damjan.jov at gmail.com>
Signed-off-by: Nikolay Sivov <nsivov at codeweavers.com>
Signed-off-by: Alexandre Julliard <julliard at winehq.org>
(cherry picked from commit 06cd8d3d2eb09ffb19f26e95360c3ddcc4caf46d)
Signed-off-by: Michael Stefaniuc <mstefani at winehq.org>

---

 dlls/msxml3/element.c      |  2 ++
 dlls/msxml3/tests/domdoc.c | 25 +++++++++++++++++++++++++
 2 files changed, 27 insertions(+)

diff --git a/dlls/msxml3/element.c b/dlls/msxml3/element.c
index 05255508d4e..de5d32c585b 100644
--- a/dlls/msxml3/element.c
+++ b/dlls/msxml3/element.c
@@ -1888,6 +1888,8 @@ static HRESULT domelem_next_node(const xmlNodePtr node, LONG *iter, IXMLDOMNode
     *nextNode = NULL;
 
     curr = node->properties;
+    if (curr == NULL)
+        return S_FALSE;
 
     for (i = 0; i < *iter; i++) {
         if (curr->next == NULL)
diff --git a/dlls/msxml3/tests/domdoc.c b/dlls/msxml3/tests/domdoc.c
index e94a2c88a81..a64bc5bc2b0 100644
--- a/dlls/msxml3/tests/domdoc.c
+++ b/dlls/msxml3/tests/domdoc.c
@@ -2203,6 +2203,8 @@ static void test_domnode( void )
 
     if (element)
     {
+        IXMLDOMNamedNodeMap *attributes;
+
         owner = NULL;
         r = IXMLDOMElement_get_ownerDocument( element, &owner );
         ok( r == S_OK, "get_ownerDocument return code\n");
@@ -2281,6 +2283,29 @@ static void test_domnode( void )
         ok( map != NULL, "should be attributes\n");
 
         EXPECT_CHILDREN(element);
+
+        r = IXMLDOMElement_get_childNodes( element, &list );
+        ok( r == S_OK, "Expected S_OK, ret %08x\n", r );
+        r = IXMLDOMNodeList_nextNode( list, &node ); /* <bs> */
+        ok( r == S_OK, "Expected S_OK, ret %08x\n", r );
+        IXMLDOMNode_Release( node );
+        r = IXMLDOMNodeList_nextNode( list, &node ); /* <pr> */
+        ok( r == S_OK, "Expected S_OK, ret %08x\n", r );
+        IXMLDOMNode_Release( node );
+        r = IXMLDOMNodeList_nextNode( list, &node ); /* <empty> */
+        ok( r == S_OK, "Expected S_OK, ret %08x\n", r );
+        r = IXMLDOMNode_get_attributes( node, &attributes );
+        ok( r == S_OK, "Expected S_OK, ret %08x\n", r );
+        next = (IXMLDOMNode*)0xdeadbeef;
+        r = IXMLDOMNamedNodeMap_nextNode( attributes, &next );
+        ok( r == S_FALSE, "Expected S_FALSE, ret %08x\n", r );
+        ok( next == NULL, "Expected NULL, ret %p\n", next );
+        IXMLDOMNamedNodeMap_Release( attributes );
+        IXMLDOMNode_Release( node );
+        node = NULL;
+        next = NULL;
+        IXMLDOMNodeList_Release( list );
+        list = NULL;
     }
     else
         ok( FALSE, "no element\n");