msxml3 xmlnodelist_QueryInterface crashes if ppvObject is NULL

External name: IXMLDOMNodeList_QueryInterface
Internal name: xmlnodelist_QueryInterface
Code location: msxml3/nodelist.c

If IXMLDOMNodeList_QueryInterface (xmlnodelist_QueryInterface) is called with a REFIID of one of the following three):
IID_IUnknown
IID_IDispatch
IID_IXMLDOMNodeList
and the output interface pointer (ppvObject) is NULL, xmlnodelist_QueryInterface crashes when it tries to read from the NULL-pointer.