From ec867bc4287dc900ad5728fcd5b0b87f9a056051 Mon Sep 17 00:00:00 2001 From: Jefferson Carpenter Date: Thu, 27 May 2021 12:36:46 +0000 Subject: [PATCH] msxml3: Null check newChild in DOMDocument insertBefore. Signed-off-by: Jefferson Carpenter Signed-off-by: Nikolay Sivov Signed-off-by: Alexandre Julliard --- dlls/msxml3/domdoc.c | 2 ++ dlls/msxml3/tests/domdoc.c | 7 +++++++ 2 files changed, 9 insertions(+) diff --git a/dlls/msxml3/domdoc.c b/dlls/msxml3/domdoc.c index 45fbd6f43aa..61fbbf9f20b 100644 --- a/dlls/msxml3/domdoc.c +++ b/dlls/msxml3/domdoc.c @@ -1210,6 +1210,8 @@ static HRESULT WINAPI domdoc_insertBefore( TRACE("(%p)->(%p %s %p)\n", This, newChild, debugstr_variant(&refChild), outNewChild); + if (!newChild) return E_INVALIDARG; + hr = IXMLDOMNode_get_nodeType(newChild, &type); if (hr != S_OK) return hr; diff --git a/dlls/msxml3/tests/domdoc.c b/dlls/msxml3/tests/domdoc.c index 12482962c4b..ea8a95252a1 100644 --- a/dlls/msxml3/tests/domdoc.c +++ b/dlls/msxml3/tests/domdoc.c @@ -9235,6 +9235,13 @@ static void test_insertBefore(void) doc = create_document(&IID_IXMLDOMDocument); doc3 = create_document(&IID_IXMLDOMDocument); + /* NULL to document */ + V_VT(&v) = VT_NULL; + node = (void*)0xdeadbeef; + hr = IXMLDOMDocument_insertBefore(doc, NULL, v, &node); + ok(hr == E_INVALIDARG, "got 0x%08x\n", hr); + ok(node == (void*)0xdeadbeef, "got %p\n", node); + /* document to document */ V_VT(&v) = VT_NULL; node = (void*)0xdeadbeef; -- 2.11.4.GIT