[PATCH] msxml3: Null check new child in insertBefore.

[Jefferson Carpenter]

From dc890adf3fdf67f72782d2d29d39dfe4bbbec947 Mon Sep 17 00:00:00 2001
From: Jefferson Carpenter <jeffersoncarpenter2 at gmail.com>
Date: Wed, 19 May 2021 06:02:56 +0000
Subject: [PATCH] msxml3: Null check new child in insertBefore.

Signed-off-by: Jefferson Carpenter <jeffersoncarpenter2 at gmail.com>
---
 dlls/msxml3/domdoc.c       |  2 ++
 dlls/msxml3/element.c      |  2 ++
 dlls/msxml3/tests/domdoc.c | 29 +++++++++++++++++++++++++++++
 3 files changed, 33 insertions(+)

diff --git a/dlls/msxml3/domdoc.c b/dlls/msxml3/domdoc.c
index 80c32e9ba99..959d56033d8 100644
--- a/dlls/msxml3/domdoc.c
+++ b/dlls/msxml3/domdoc.c
@@ -1175,6 +1175,8 @@ static HRESULT WINAPI domdoc_insertBefore(
 
     TRACE("(%p)->(%p %s %p)\n", This, newChild, debugstr_variant(&refChild), outNewChild);
 
+    if (!newChild) return E_INVALIDARG;
+
     hr = IXMLDOMNode_get_nodeType(newChild, &type);
     if (hr != S_OK) return hr;
 
diff --git a/dlls/msxml3/element.c b/dlls/msxml3/element.c
index 05255508d4e..5891653a76f 100644
--- a/dlls/msxml3/element.c
+++ b/dlls/msxml3/element.c
@@ -309,6 +309,8 @@ static HRESULT WINAPI domelem_insertBefore(
 
     TRACE("(%p)->(%p %s %p)\n", This, newNode, debugstr_variant(&refChild), old_node);
 
+    if (!newNode) return E_INVALIDARG;
+
     hr = IXMLDOMNode_get_nodeType(newNode, &type);
     if (hr != S_OK) return hr;
 
diff --git a/dlls/msxml3/tests/domdoc.c b/dlls/msxml3/tests/domdoc.c
index 5bc2fe1d5c3..0b61721d107 100644
--- a/dlls/msxml3/tests/domdoc.c
+++ b/dlls/msxml3/tests/domdoc.c
@@ -9155,6 +9155,13 @@ static void test_insertBefore(void)
     doc = create_document(&IID_IXMLDOMDocument);
     doc3 = create_document(&IID_IXMLDOMDocument);
 
+    /* NULL to document */
+    V_VT(&v) = VT_NULL;
+    node = (void*)0xdeadbeef;
+    hr = IXMLDOMDocument_insertBefore(doc, (IXMLDOMNode*)NULL, v, &node);
+    ok(hr == E_INVALIDARG, "got 0x%08x\n", hr);
+    ok(node == (void*)0xdeadbeef, "got %p\n", node);
+
     /* document to document */
     V_VT(&v) = VT_NULL;
     node = (void*)0xdeadbeef;
@@ -9196,6 +9203,13 @@ static void test_insertBefore(void)
 
     EXPECT_NO_CHILDREN(cdata);
 
+    /* NULL to cdata */
+    V_VT(&v) = VT_NULL;
+    node = (void*)0xdeadbeef;
+    hr = IXMLDOMNode_insertBefore(cdata, (IXMLDOMNode*)NULL, v, &node);
+    ok(hr == E_INVALIDARG, "got 0x%08x\n", hr);
+    ok(node == (void*)0xdeadbeef, "got %p\n", node);
+
     /* attribute to cdata */
     V_VT(&v) = VT_NULL;
     node = (void*)0xdeadbeef;
@@ -9219,6 +9233,13 @@ static void test_insertBefore(void)
     IXMLDOMNode_Release(cdata);
     IXMLDOMDocument_Release(doc3);
 
+    /* NULL to attribute */
+    V_VT(&v) = VT_NULL;
+    node = (void*)0xdeadbeef;
+    hr = IXMLDOMAttribute_insertBefore(attr, (IXMLDOMNode*)NULL, v, &node);
+    ok(hr == E_INVALIDARG, "got 0x%08x\n", hr);
+    ok(node == (void*)0xdeadbeef, "got %p\n", node);
+
     /* attribute to attribute */
     V_VT(&v) = VT_I4;
     V_I4(&v) = NODE_ATTRIBUTE;
@@ -9324,12 +9345,20 @@ static void test_insertBefore(void)
 
     todo_wine EXPECT_REF(elem2, 2);
 
+    /* NULL to element */
+    V_VT(&v) = VT_NULL;
+    node = (void*)0xdeadbeef;
+    hr = IXMLDOMElement_insertBefore(elem1, (IXMLDOMNode*)NULL, v, &node);
+    ok(hr == E_INVALIDARG, "got 0x%08x\n", hr);
+    ok(node == (void*)0xdeadbeef, "got %p\n", node);
+
     /* document to element */
     V_VT(&v) = VT_DISPATCH;
     V_DISPATCH(&v) = NULL;
     hr = IXMLDOMElement_insertBefore(elem1, (IXMLDOMNode*)doc, v, NULL);
     ok(hr == E_FAIL, "got 0x%08x\n", hr);
 
+    /* element to element */
     V_VT(&v) = VT_DISPATCH;
     V_DISPATCH(&v) = NULL;
     node = NULL;
-- 
2.26.2