Commit 2dc6711f authored by Nikolay Sivov's avatar Nikolay Sivov Committed by Alexandre Julliard

msxml3: Protect content callbacks from being called on reset content handler pointer.

parent 593bd1a5
......@@ -313,7 +313,7 @@ static BOOL is_namespaces_enabled(const saxreader *reader)
return (reader->version < MSXML4) || (reader->features & Namespaces);
}
static inline BOOL has_content_handler(const saxlocator *locator)
static inline int has_content_handler(const saxlocator *locator)
{
return (locator->vbInterface && locator->saxreader->vbcontentHandler) ||
(!locator->vbInterface && locator->saxreader->contentHandler);
......@@ -1288,6 +1288,7 @@ static void libxmlStartElementNS(
saxlocator *This = ctx;
element_entry *element;
HRESULT hr = S_OK;
BSTR uri;
update_position(This, TRUE);
if(*(This->pParserCtxt->input->cur) == '/')
......@@ -1298,15 +1299,11 @@ static void libxmlStartElementNS(
element = alloc_element_entry(localname, prefix, nb_namespaces, namespaces);
push_element_ns(This, element);
if (has_content_handler(This))
{
BSTR uri;
if (is_namespaces_enabled(This->saxreader))
{
int i;
for (i = 0; i < nb_namespaces; i++)
for (i = 0; i < nb_namespaces && has_content_handler(This); i++)
{
if (This->vbInterface)
hr = IVBSAXContentHandler_startPrefixMapping(
......@@ -1330,9 +1327,8 @@ static void libxmlStartElementNS(
}
uri = find_element_uri(This, URI);
hr = SAXAttributes_populate(This, nb_namespaces, namespaces, nb_attributes, attributes);
if (hr == S_OK)
if (hr == S_OK && has_content_handler(This))
{
BSTR local;
......@@ -1350,11 +1346,10 @@ static void libxmlStartElementNS(
local, SysStringLen(local),
element->qname, SysStringLen(element->qname),
&This->ISAXAttributes_iface);
}
}
if (sax_callback_failed(This, hr))
format_error_message_from_id(This, hr);
}
}
static void libxmlEndElementNS(
......@@ -1435,7 +1430,7 @@ static void libxmlEndElementNS(
if (is_namespaces_enabled(This->saxreader))
{
int i = -1;
while (iterate_endprefix_index(This, element, &i))
while (iterate_endprefix_index(This, element, &i) && has_content_handler(This))
{
if (This->vbInterface)
hr = IVBSAXContentHandler_endPrefixMapping(
......@@ -1447,10 +1442,10 @@ static void libxmlEndElementNS(
if (sax_callback_failed(This, hr)) break;
}
}
if (sax_callback_failed(This, hr))
format_error_message_from_id(This, hr);
}
free_element_entry(element);
}
......@@ -1587,6 +1582,7 @@ static void libxmlComment(void *ctx, const xmlChar *value)
This->line--;
p--;
}
This->column = 0;
for(; p>=This->pParserCtxt->input->base && *p!='\n' && *p!='\r'; p--)
This->column++;
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment