Fabian Maurer : kernel32: Prevent null pointer dereference in WritePrivateProfileStructW.

[Alexandre Julliard]

Module: wine
Branch: oldstable
Commit: b3305f6134f92f8a8c6f6395bfa785be076dfd86
URL:    https://gitlab.winehq.org/wine/wine/-/commit/b3305f6134f92f8a8c6f6395bfa785b...

Author: Fabian Maurer 
Date:   Mon May 16 19:29:10 2022 +0200

kernel32: Prevent null pointer dereference in WritePrivateProfileStructW.

Wine-Bug: https://bugs.winehq.org/show_bug.cgi?id=49285
Signed-off-by: Fabian Maurer 
Signed-off-by: Alexandre Julliard 
(cherry picked from commit f391e9cf1ed597dd2d427ebef240b6c4244e2201)
Conflicts:
    dlls/kernel32/tests/profile.c
Signed-off-by: Michael Stefaniuc

---

dlls/kernel32/profile.c       | 5 +++++
 dlls/kernel32/tests/profile.c | 6 ++++++
 2 files changed, 11 insertions(+)

diff --git a/dlls/kernel32/profile.c b/dlls/kernel32/profile.c
index 92c163700ac..536f5f88d2d 100644
--- a/dlls/kernel32/profile.c
+++ b/dlls/kernel32/profile.c
@@ -2044,9 +2044,14 @@ BOOL WINAPI WritePrivateProfileStructW (LPCWSTR section, LPCWSTR key,
     LPWSTR outstring, p;
     DWORD sum = 0;

+    TRACE("(%s %s %p %u %s)\n", debugstr_w(section), debugstr_w(key), buf, bufsize, debugstr_w(filename));
+
     if (!section && !key && !buf)  /* flush the cache */
         return WritePrivateProfileStringW( NULL, NULL, NULL, filename );

+    if (!buf)
+        return WritePrivateProfileStringW(section, key, NULL, filename);
+
     /* allocate string buffer for hex chars + checksum hex char + '\0' */
     outstring = HeapAlloc( GetProcessHeap(), 0, (bufsize*2 + 2 + 1) * sizeof(WCHAR) );
     p = outstring;
diff --git a/dlls/kernel32/tests/profile.c b/dlls/kernel32/tests/profile.c
index 94ef0a85467..bc93f0741d5 100644
--- a/dlls/kernel32/tests/profile.c
+++ b/dlls/kernel32/tests/profile.c
@@ -1109,6 +1109,7 @@ static void test_WritePrivateProfileString(void)
 static void test_profile_struct(void)
 {
     static const char expect_data[] = "[s]\r\nkey=616261637573006F\r\n";
+    static const char expect_data_empty[] = "[s]\r\n";
     char buffer[20];
     BOOL ret;

@@ -1173,6 +1174,11 @@ static void test_profile_struct(void)
     ok(!ret, "expected failure\n");
     todo_wine ok(GetLastError() == ERROR_BAD_LENGTH, "got error %u\n", GetLastError());

+    /* Test deleting struct */
+    ret = WritePrivateProfileStructA("s", "key", NULL, sizeof("abacus"), "./winetest.ini");
+    ok(ret, "got error %u\n", GetLastError());
+    ok(check_file_data("./winetest.ini", expect_data_empty), "file doesn't match\n");
+
     ret = DeleteFileA("./winetest.ini");
     ok(ret, "got error %u\n", GetLastError());
 }