webservices: Reject end elements without a parent in the writer.

dlls/webservices/reader.c

@@ -1063,8 +1063,8 @@ static BOOL cmp_localname( const unsigned char *name1, ULONG len1, const unsigne
     return TRUE;
 }
 
-static struct node *find_parent_element( struct node *node, const WS_XML_STRING *prefix,
-                                         const WS_XML_STRING *localname )
+struct node *find_parent_element( struct node *node, const WS_XML_STRING *prefix,
+                                  const WS_XML_STRING *localname )
 {
     struct node *parent;
     const WS_XML_STRING *str;

dlls/webservices/webservices_private.h

@@ -32,6 +32,8 @@ WS_XML_STRING *alloc_xml_string( const unsigned char *, ULONG ) DECLSPEC_HIDDEN;
 WS_XML_UTF8_TEXT *alloc_utf8_text( const unsigned char *, ULONG ) DECLSPEC_HIDDEN;
 HRESULT append_attribute( WS_XML_ELEMENT_NODE *, WS_XML_ATTRIBUTE * ) DECLSPEC_HIDDEN;
 void free_attribute( WS_XML_ATTRIBUTE * ) DECLSPEC_HIDDEN;
+struct node *find_parent_element( struct node *, const WS_XML_STRING *,
+                                  const WS_XML_STRING * ) DECLSPEC_HIDDEN;
 
 struct node
 {

dlls/webservices/writer.c

@@ -546,10 +546,13 @@ static HRESULT write_startelement( struct writer *writer )
 
 static HRESULT write_endelement( struct writer *writer )
 {
-    WS_XML_ELEMENT_NODE *elem = (WS_XML_ELEMENT_NODE *)writer->current;
+    struct node *node = find_parent_element( writer->current, NULL, NULL );
+    WS_XML_ELEMENT_NODE *elem = &node->hdr;
     ULONG size;
     HRESULT hr;
 
+    if (!elem) return WS_E_INVALID_FORMAT;
+
     /* '</prefix:localname>' */
 
     size = elem->localName->length + 3 /* '</>' */;