You should write some tests to examine the behavior of VerQueryValue with NULL puLen.
I just found out that wine has a test for it, but it has been commented out:
if (0) { /* this test crashes on WinNT4 */ boolret = VerQueryValueA( pVersionInfo, backslash, (LPVOID *)&pFixedVersionInfo, 0); ok (boolret, "VerQueryValue failed: GetLastError = %u\n", GetLastError()); }
Cheers, Rafael