[PATCH 0/2] MR5217: advapi32: Check NULL return key pointers when creating registry keys.

[Zhiyi Zhang (＠zhiyi)]

Fix Warlords Battlecry III (433280) crashes at launch.

[PATCH 1/2] advapi32: Check NULL return key pointers when creating registry keys.

[Zhiyi Zhang]

From: Zhiyi Zhang

Fix Warlords Battlecry III (433280) crashes at launch.
---
 dlls/advapi32/registry.c   | 6 ++++++
 dlls/kernelbase/registry.c | 2 ++
 2 files changed, 8 insertions(+)

diff --git a/dlls/advapi32/registry.c b/dlls/advapi32/registry.c
index 85e883bdcc9..e3226c38d0a 100644
--- a/dlls/advapi32/registry.c
+++ b/dlls/advapi32/registry.c
@@ -70,6 +70,9 @@ LSTATUS WINAPI RegOverridePredefKey( HKEY hkey, HKEY override )
  */
 LSTATUS WINAPI RegCreateKeyW( HKEY hkey, LPCWSTR lpSubKey, PHKEY phkResult )
 {
+    if (!phkResult)
+        return ERROR_INVALID_PARAMETER;
+
     return RegCreateKeyExW( hkey, lpSubKey, 0, NULL, REG_OPTION_NON_VOLATILE,
                             MAXIMUM_ALLOWED, NULL, phkResult, NULL );
 }
@@ -82,6 +85,9 @@ LSTATUS WINAPI RegCreateKeyW( HKEY hkey, LPCWSTR lpSubKey, PHKEY phkResult )
  */
 LSTATUS WINAPI RegCreateKeyA( HKEY hkey, LPCSTR lpSubKey, PHKEY phkResult )
 {
+    if (!phkResult)
+        return ERROR_INVALID_PARAMETER;
+
     return RegCreateKeyExA( hkey, lpSubKey, 0, NULL, REG_OPTION_NON_VOLATILE,
                             MAXIMUM_ALLOWED, NULL, phkResult, NULL );
 }
diff --git a/dlls/kernelbase/registry.c b/dlls/kernelbase/registry.c
index dcdb1cf84eb..ee57a4acdd1 100644
--- a/dlls/kernelbase/registry.c
+++ b/dlls/kernelbase/registry.c
@@ -592,6 +592,7 @@ LSTATUS WINAPI DECLSPEC_HOTPATCH RegCreateKeyExW( HKEY hkey, LPCWSTR name, DWORD
 {
     UNICODE_STRING nameW, classW;

+    if (!retkey) return ERROR_BADKEY;
     if (reserved) return ERROR_INVALID_PARAMETER;
     if (!(hkey = get_special_root_hkey( hkey ))) return ERROR_INVALID_HANDLE;

@@ -633,6 +634,7 @@ LSTATUS WINAPI DECLSPEC_HOTPATCH RegCreateKeyExA( HKEY hkey, LPCSTR name, DWORD
     ANSI_STRING nameA, classA;
     NTSTATUS status;

+    if (!retkey) return ERROR_BADKEY;
     if (reserved) return ERROR_INVALID_PARAMETER;
     if (!is_version_nt())
     {

[PATCH 2/2] advapi32/tests: Test creating registry keys with a NULL return key pointer.

[Zhiyi Zhang]

From: Zhiyi Zhang

---
 dlls/advapi32/tests/registry.c | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/dlls/advapi32/tests/registry.c b/dlls/advapi32/tests/registry.c
index d66b10e8952..27ee3fbbe30 100644
--- a/dlls/advapi32/tests/registry.c
+++ b/dlls/advapi32/tests/registry.c
@@ -1279,6 +1279,19 @@ static void test_reg_create_key(void)
     PACL key_acl;
     SECURITY_DESCRIPTOR *sd;

+    /* NULL return key check */
+    ret = RegCreateKeyA(hkey_main, "Subkey1", NULL);
+    ok(ret == ERROR_INVALID_PARAMETER, "Got unexpected ret %ld.\n", ret);
+
+    ret = RegCreateKeyW(hkey_main, L"Subkey1", NULL);
+    ok(ret == ERROR_INVALID_PARAMETER, "Got unexpected ret %ld.\n", ret);
+
+    ret = RegCreateKeyExA(hkey_main, "Subkey1", 0, NULL, 0, KEY_NOTIFY, NULL, NULL, NULL);
+    ok(ret == ERROR_BADKEY, "Got unexpected ret %ld.\n", ret);
+
+    ret = RegCreateKeyExW(hkey_main, L"Subkey1", 0, NULL, 0, KEY_NOTIFY, NULL, NULL, NULL);
+    ok(ret == ERROR_BADKEY, "Got unexpected ret %ld.\n", ret);
+
     ret = RegCreateKeyExA(hkey_main, "Subkey1", 0, NULL, 0, KEY_NOTIFY, NULL, &hkey1, NULL);
     ok(!ret, "RegCreateKeyExA failed with error %ld\n", ret);
     /* should succeed: all versions of Windows ignore the access rights