[Patch resend] msxml3: Fix crash when iterating through attributes with namespaces.

[Nikolay Sivov]

On 8/29/21 4:19 PM, Bernhard Übelacker wrote:
>  
> +static const char svg[] =
> +    "<svg version=\"1.1\" xmlns=\"http://www.w3.org/2000/svg\" xmlns:xlink=\"http://www.w3.org/1999/xlink\"></svg>";
> +
> +static void test_prefixless_namespace(void)
> +{
> +    HRESULT hr;
> +    IXMLDOMDocument *doc;
> +    VARIANT_BOOL b;
> +    BSTR str;
> +    IXMLDOMNodeList *node_list;
> +    LONG length;
> +    IXMLDOMNode *node1;
> +    IXMLDOMNode *node2;
> +    IXMLDOMNamedNodeMap *node_map;
> +    int found;
> +
> +    doc = create_document(&IID_IXMLDOMDocument);
> +    EXPECT_REF(doc, 1);
> +
> +    hr = IXMLDOMDocument_loadXML(doc, _bstr_(svg), &b);
> +    EXPECT_HR(hr, S_OK);
> +
> +    hr = IXMLDOMDocument_get_childNodes(doc, &node_list);
> +    EXPECT_HR(hr, S_OK);
> +
> +    hr = IXMLDOMNodeList_get_item(node_list, 0, &node1);
> +    EXPECT_HR(hr, S_OK);
> +
> +    node_map = (void *)0xdeadbeef;
> +    hr = IXMLDOMNode_get_attributes(node1, &node_map);
> +    EXPECT_HR(hr, S_OK);
> +
> +    length = 0xdeadbeef;
> +    hr = IXMLDOMNamedNodeMap_get_length(node_map, &length);
> +    EXPECT_HR(hr, S_OK);
> +    ok(length == 3, "expected length=%d, got %d\n", 3, length);
> +
> +    found = 0;
> +    for (int i = 0; i < length; i++)
> +    {
> +        hr = IXMLDOMNamedNodeMap_get_item(node_map, i, &node2);
> +        EXPECT_HR(hr, S_OK);
> +
> +        str = (void *)0xdeadbeef;
> +        hr = IXMLDOMNode_get_xml(node2, &str);
> +        EXPECT_HR(hr, S_OK);
> +        if (lstrcmpW(str, L"version=\"1.1\"") == 0) found++;
> +        if (lstrcmpW(str, L"xmlns=\"http://www.w3.org/2000/svg\"") == 0) found++;
> +        if (lstrcmpW(str, L"xmlns:xlink=\"http://www.w3.org/1999/xlink\"") == 0) found++;
> +        SysFreeString(str);
> +
> +        IXMLDOMNode_Release(node2);
> +    }
> +    ok(found == 3, "expected to find %d elements, found %d\n", 3, found);
> +
> +    IXMLDOMNamedNodeMap_Release(node_map);
> +    IXMLDOMNode_Release(node1);
> +    IXMLDOMNodeList_Release(node_list);
> +    IXMLDOMDocument_Release(doc);
> +}
> +
>  START_TEST(domdoc)
>  {
>      HRESULT hr;
> @@ -13745,6 +13806,7 @@ START_TEST(domdoc)
>          test_mxnamespacemanager();
>          test_mxnamespacemanager_override();
>      }
> +    test_prefixless_namespace();
>
Hi, Bernhard. Sorry for the delay.

Please use existing test function, like test_namespaces_as_attributes().