Hans Leidekker : userenv: GetProfilesDirectoryW accepts a NULL buffer.

[Alexandre Julliard]

Module: wine
Branch: master
Commit: 1c6ea02ffa1510056551404a6b777dcc6a4a307a
URL:    http://source.winehq.org/git/wine.git/?a=commit;h=1c6ea02ffa1510056551404a6b...

Author: Hans Leidekker <hans(a)codeweavers.com>
Date:   Wed Mar  2 10:46:44 2011 +0100

userenv: GetProfilesDirectoryW accepts a NULL buffer.

---

 dlls/userenv/tests/userenv.c |   17 +++++++++++++++++
 dlls/userenv/userenv_main.c  |    4 ++--
 2 files changed, 19 insertions(+), 2 deletions(-)

diff --git a/dlls/userenv/tests/userenv.c b/dlls/userenv/tests/userenv.c
index 446870f..c96b710 100644
--- a/dlls/userenv/tests/userenv.c
+++ b/dlls/userenv/tests/userenv.c
@@ -264,6 +264,23 @@ static void test_get_profiles_dir(void)
 
     HeapFree(GetProcessHeap(), 0, buf);
     HeapFree(GetProcessHeap(), 0, profiles_dir);
+
+    SetLastError(0xdeadbeef);
+    r = GetProfilesDirectoryW(NULL, NULL);
+    expect(FALSE, r);
+    expect_gle(ERROR_INVALID_PARAMETER);
+
+    cch = 0;
+    SetLastError(0xdeadbeef);
+    r = GetProfilesDirectoryW(NULL, &cch);
+    expect(FALSE, r);
+    expect_gle(ERROR_INSUFFICIENT_BUFFER);
+    ok(cch, "expected cch > 0\n");
+
+    SetLastError(0xdeadbeef);
+    r = GetProfilesDirectoryW(NULL, &cch);
+    expect(FALSE, r);
+    expect_gle(ERROR_INSUFFICIENT_BUFFER);
 }
 
 START_TEST(userenv)
diff --git a/dlls/userenv/userenv_main.c b/dlls/userenv/userenv_main.c
index 59b3b1f..4204472 100644
--- a/dlls/userenv/userenv_main.c
+++ b/dlls/userenv/userenv_main.c
@@ -201,7 +201,7 @@ BOOL WINAPI GetProfilesDirectoryW( LPWSTR lpProfilesDir, LPDWORD lpcchSize )
 
     TRACE("%p %p\n", lpProfilesDir, lpcchSize );
 
-    if (!lpProfilesDir || !lpcchSize)
+    if (!lpcchSize)
     {
         SetLastError(ERROR_INVALID_PARAMETER);
         return FALSE;
@@ -234,7 +234,7 @@ BOOL WINAPI GetProfilesDirectoryW( LPWSTR lpProfilesDir, LPDWORD lpcchSize )
     }
     expanded_len = ExpandEnvironmentStringsW(unexpanded_profiles_dir, NULL, 0);
     /* The returned length doesn't include the NULL terminator. */
-    if (*lpcchSize < expanded_len - 1)
+    if (*lpcchSize < expanded_len - 1 || !lpProfilesDir)
     {
         *lpcchSize = expanded_len - 1;
         SetLastError(ERROR_INSUFFICIENT_BUFFER);