[Patch resend] msxml3: Fix crash when iterating through attributes with namespaces.

[Bernhard Übelacker]

Am 06.09.21 um 15:26 schrieb Nikolay Sivov:
> 
> 
> On 8/29/21 4:19 PM, Bernhard Übelacker wrote:
>>   
>> +static const char svg[] =
>> +    "<svg version=\"1.1\" xmlns=\"http://www.w3.org/2000/svg\" xmlns:xlink=\"http://www.w3.org/1999/xlink\"></svg>";
>> +
>> +static void test_prefixless_namespace(void)
>> +{
>> +    HRESULT hr;
>> +    IXMLDOMDocument *doc;
>> +    VARIANT_BOOL b;
>> +    BSTR str;
>> +    IXMLDOMNodeList *node_list;
>> +    LONG length;
>> +    IXMLDOMNode *node1;
>> +    IXMLDOMNode *node2;
>> +    IXMLDOMNamedNodeMap *node_map;
>> +    int found;
>> +
>> +    doc = create_document(&IID_IXMLDOMDocument);
>> +    EXPECT_REF(doc, 1);
>> +
>> +    hr = IXMLDOMDocument_loadXML(doc, _bstr_(svg), &b);
>> +    EXPECT_HR(hr, S_OK);
>> +
>> +    hr = IXMLDOMDocument_get_childNodes(doc, &node_list);
>> +    EXPECT_HR(hr, S_OK);
>> +
>> +    hr = IXMLDOMNodeList_get_item(node_list, 0, &node1);
>> +    EXPECT_HR(hr, S_OK);
>> +
>> +    node_map = (void *)0xdeadbeef;
>> +    hr = IXMLDOMNode_get_attributes(node1, &node_map);
>> +    EXPECT_HR(hr, S_OK);
>> +
>> +    length = 0xdeadbeef;
>> +    hr = IXMLDOMNamedNodeMap_get_length(node_map, &length);
>> +    EXPECT_HR(hr, S_OK);
>> +    ok(length == 3, "expected length=%d, got %d\n", 3, length);
>> +
>> +    found = 0;
>> +    for (int i = 0; i < length; i++)
>> +    {
>> +        hr = IXMLDOMNamedNodeMap_get_item(node_map, i, &node2);
>> +        EXPECT_HR(hr, S_OK);
>> +
>> +        str = (void *)0xdeadbeef;
>> +        hr = IXMLDOMNode_get_xml(node2, &str);
>> +        EXPECT_HR(hr, S_OK);
>> +        if (lstrcmpW(str, L"version=\"1.1\"") == 0) found++;
>> +        if (lstrcmpW(str, L"xmlns=\"http://www.w3.org/2000/svg\"") == 0) found++;
>> +        if (lstrcmpW(str, L"xmlns:xlink=\"http://www.w3.org/1999/xlink\"") == 0) found++;
>> +        SysFreeString(str);
>> +
>> +        IXMLDOMNode_Release(node2);
>> +    }
>> +    ok(found == 3, "expected to find %d elements, found %d\n", 3, found);
>> +
>> +    IXMLDOMNamedNodeMap_Release(node_map);
>> +    IXMLDOMNode_Release(node1);
>> +    IXMLDOMNodeList_Release(node_list);
>> +    IXMLDOMDocument_Release(doc);
>> +}
>> +
>>   START_TEST(domdoc)
>>   {
>>       HRESULT hr;
>> @@ -13745,6 +13806,7 @@ START_TEST(domdoc)
>>           test_mxnamespacemanager();
>>           test_mxnamespacemanager_override();
>>       }
>> +    test_prefixless_namespace();
>>
> Hi, Bernhard. Sorry for the delay.
> 
> Please use existing test function, like test_namespaces_as_attributes().
> 


Hello Nikolay,
thanks for the review.
I tried to move the test into test_namespaces_as_attributes().

Unfortunately it looks like I hit there some differences between
the msxml40/msxml60 and msxml30 and below.

Also it showed that my proposed change is not
sufficient to succeed all tests, just makes it not crash.

This is a testbot run with testing just msxml30 and below,
that succeeds windows, but crashes with wine.

https://testbot.winehq.org/JobDetails.pl?Key=97653

Kind regards,
Bernhard