msxml3: Protect content callbacks from being called on reset content handler pointer.

dlls/msxml3/saxreader.c

@@ -313,7 +313,7 @@ static BOOL is_namespaces_enabled(const saxreader *reader)
     return (reader->version < MSXML4) || (reader->features & Namespaces);
 }
 
-static inline BOOL has_content_handler(const saxlocator *locator)
+static inline int has_content_handler(const saxlocator *locator)
 {
     return  (locator->vbInterface && locator->saxreader->vbcontentHandler) ||
            (!locator->vbInterface && locator->saxreader->contentHandler);
@@ -1288,6 +1288,7 @@ static void libxmlStartElementNS(
     saxlocator *This = ctx;
     element_entry *element;
     HRESULT hr = S_OK;
+    BSTR uri;
 
     update_position(This, TRUE);
     if(*(This->pParserCtxt->input->cur) == '/')
@@ -1298,15 +1299,11 @@ static void libxmlStartElementNS(
     element = alloc_element_entry(localname, prefix, nb_namespaces, namespaces);
     push_element_ns(This, element);
 
-    if (has_content_handler(This))
-    {
-        BSTR uri;
-
     if (is_namespaces_enabled(This->saxreader))
     {
         int i;
 
-            for (i = 0; i < nb_namespaces; i++)
+        for (i = 0; i < nb_namespaces && has_content_handler(This); i++)
         {
             if (This->vbInterface)
                 hr = IVBSAXContentHandler_startPrefixMapping(
@@ -1330,9 +1327,8 @@ static void libxmlStartElementNS(
     }
 
     uri = find_element_uri(This, URI);
-
     hr = SAXAttributes_populate(This, nb_namespaces, namespaces, nb_attributes, attributes);
-        if (hr == S_OK)
+    if (hr == S_OK && has_content_handler(This))
     {
         BSTR local;
 
@@ -1350,11 +1346,10 @@ static void libxmlStartElementNS(
                     local, SysStringLen(local),
                     element->qname, SysStringLen(element->qname),
                     &This->ISAXAttributes_iface);
-        }
-    }
 
        if (sax_callback_failed(This, hr))
            format_error_message_from_id(This, hr);
+    }
 }
 
 static void libxmlEndElementNS(
@@ -1435,7 +1430,7 @@ static void libxmlEndElementNS(
     if (is_namespaces_enabled(This->saxreader))
     {
         int i = -1;
-        while (iterate_endprefix_index(This, element, &i))
+        while (iterate_endprefix_index(This, element, &i) && has_content_handler(This))
         {
             if (This->vbInterface)
                 hr = IVBSAXContentHandler_endPrefixMapping(
@@ -1447,10 +1442,10 @@ static void libxmlEndElementNS(
 
             if (sax_callback_failed(This, hr)) break;
        }
-    }
 
        if (sax_callback_failed(This, hr))
            format_error_message_from_id(This, hr);
+    }
 
     free_element_entry(element);
 }
@@ -1587,6 +1582,7 @@ static void libxmlComment(void *ctx, const xmlChar *value)
             This->line--;
         p--;
     }
+
     This->column = 0;
     for(; p>=This->pParserCtxt->input->base && *p!='\n' && *p!='\r'; p--)
         This->column++;