msxml3: Don't crash on null pointer when doing ::Next() on a last child.

dlls/msxml3/tests/xmlelem.c

@@ -357,6 +357,16 @@ static void test_xmlelem_collection(void)
     ok(V_VT(&var) == VT_DISPATCH, "Expected VT_DISPATCH, got %d\n", V_VT(&var));
     ok(num_vars == 1, "Expected 1, got %d\n", num_vars);
 
+    /* try advance further, no children left */
+    hr = IEnumVARIANT_Next(enumVar, 1, &var, &num_vars);
+    ok(hr == S_FALSE, "Expected S_FALSE, got %08x\n", hr);
+    ok(V_VT(&var) == 0, "Expected 0, got %d\n", V_VT(&var));
+    ok(num_vars == 0, "Expected 0, got %d\n", num_vars);
+
+    hr = IEnumVARIANT_Next(enumVar, 1, &var, NULL);
+    ok(hr == S_FALSE, "Expected S_FALSE, got %08x\n", hr);
+    ok(V_VT(&var) == 0, "Expected 0, got %d\n", V_VT(&var));
+
     hr = IUnknown_QueryInterface(V_DISPATCH(&var), &IID_IXMLElement, (LPVOID *)&child);
     ok(hr == S_OK, "Expected S_OK, got %08x\n", hr);
     ok(child != NULL, "Expected non-NULL child\n");

dlls/msxml3/xmlelem.c

@@ -723,21 +723,28 @@ static ULONG WINAPI xmlelem_collection_IEnumVARIANT_Release(
 }
 
 static HRESULT WINAPI xmlelem_collection_IEnumVARIANT_Next(
-    IEnumVARIANT *iface, ULONG celt, VARIANT *rgVar, ULONG *pCeltFetched)
+    IEnumVARIANT *iface, ULONG celt, VARIANT *rgVar, ULONG *fetched)
 {
     xmlelem_collection *This = impl_from_IEnumVARIANT(iface);
     xmlNodePtr ptr = This->current;
 
-    TRACE("(%p, %d, %p, %p)\n", iface, celt, rgVar, pCeltFetched);
+    TRACE("(%p, %d, %p, %p)\n", iface, celt, rgVar, fetched);
 
     if (!rgVar)
         return E_INVALIDARG;
 
     /* FIXME: handle celt */
-    if (pCeltFetched)
-        *pCeltFetched = 1;
+    if (fetched)
+        *fetched = 1;
 
-    This->current = This->current->next;
+    if (This->current)
+        This->current = This->current->next;
+    else
+    {
+        V_VT(rgVar) = VT_EMPTY;
+        if (fetched) *fetched = 0;
+        return S_FALSE;
+    }
 
     V_VT(rgVar) = VT_DISPATCH;
     return XMLElement_create((IUnknown *)iface, ptr, (LPVOID *)&V_DISPATCH(rgVar), FALSE);