[PATCH 1/3] ntdll: Handle NULL object name buffer in nt_to_unix_file_name_attr().

[Paul Gofman]

Signed-off-by: Paul Gofman 
---
 dlls/ntdll/directory.c  |  8 ++++++++
 dlls/ntdll/tests/file.c | 22 +++++++++++++++++++++-
 2 files changed, 29 insertions(+), 1 deletion(-)

diff --git a/dlls/ntdll/directory.c b/dlls/ntdll/directory.c
index b8cfe507ed..0df6c1ce42 100644
--- a/dlls/ntdll/directory.c
+++ b/dlls/ntdll/directory.c
@@ -2674,8 +2674,16 @@ NTSTATUS nt_to_unix_file_name_attr( const OBJECT_ATTRIBUTES *attr, ANSI_STRING *
     NTSTATUS status;
     BOOLEAN check_case = !(attr->Attributes & OBJ_CASE_INSENSITIVE);

+    if (!attr->ObjectName->Buffer && attr->ObjectName->Length)
+        return STATUS_ACCESS_VIOLATION;
+
     if (!attr->RootDirectory)  /* without root dir fall back to normal lookup */
+    {
+        if (!attr->ObjectName->Buffer)
+            return STATUS_OBJECT_PATH_SYNTAX_BAD;
+
         return wine_nt_to_unix_file_name( attr->ObjectName, unix_name_ret, disposition, check_case );
+    }

name     = attr->ObjectName->Buffer;
     name_len = attr->ObjectName->Length / sizeof(WCHAR);
diff --git a/dlls/ntdll/tests/file.c b/dlls/ntdll/tests/file.c
index 31c18454f0..4243a7631c 100644
--- a/dlls/ntdll/tests/file.c
+++ b/dlls/ntdll/tests/file.c
@@ -144,16 +144,36 @@ static void create_file_test(void)
     static const WCHAR pathInvalidDosW[] = {'\','D','o','s','D','e','v','i','c','e','s','\',0};
     static const char testdata[] = "Hello World";
     FILE_NETWORK_OPEN_INFORMATION info;
+    UNICODE_STRING nameW, null_string;
     NTSTATUS status;
     HANDLE dir, file;
     WCHAR path[MAX_PATH];
     OBJECT_ATTRIBUTES attr;
     IO_STATUS_BLOCK io;
-    UNICODE_STRING nameW;
     LARGE_INTEGER offset;
     char buf[32];
     DWORD ret;

+    attr.Length = sizeof(attr);
+    attr.RootDirectory = NULL;
+    attr.ObjectName = &null_string;
+    attr.Attributes = 0;
+    attr.SecurityDescriptor = NULL;
+    attr.SecurityQualityOfService = NULL;
+
+    null_string.Buffer = NULL;
+    null_string.Length = 256;
+
+    /* try various open modes and options on directories */
+    status = pNtCreateFile( &dir, GENERIC_READ|GENERIC_WRITE, &attr, &io, NULL, 0,
+                            FILE_SHARE_READ|FILE_SHARE_WRITE, FILE_OPEN, FILE_DIRECTORY_FILE, NULL, 0 );
+    ok( status == STATUS_ACCESS_VIOLATION, "Got unexpected status %#x.\n",  status );
+
+    null_string.Length = 0;
+    status = pNtCreateFile( &dir, GENERIC_READ|GENERIC_WRITE, &attr, &io, NULL, 0,
+                            FILE_SHARE_READ|FILE_SHARE_WRITE, FILE_OPEN, FILE_DIRECTORY_FILE, NULL, 0 );
+    ok( status == STATUS_OBJECT_PATH_SYNTAX_BAD, "Got unexpected status %#x.\n",  status );
+
     GetCurrentDirectoryW( MAX_PATH, path );
     pRtlDosPathNameToNtPathName_U( path, &nameW, NULL, NULL );
     attr.Length = sizeof(attr);