From 2c061dbae6706d0a4d4f67919603d3c88839c84f Mon Sep 17 00:00:00 2001
From: Hans Leidekker <hans@it.vu.nl>
Date: Wed, 26 Sep 2007 14:09:46 +0200
Subject: [PATCH] kernel32: Check for NULL output buffer in FormatMessage{A,
 W}.

---
 dlls/kernel32/format_msg.c       | 12 ++++++++++++
 dlls/kernel32/tests/format_msg.c | 18 ++++++++++++++++++
 2 files changed, 30 insertions(+)

diff --git a/dlls/kernel32/format_msg.c b/dlls/kernel32/format_msg.c
index b91dbaf28af..62def9c87a0 100644
--- a/dlls/kernel32/format_msg.c
+++ b/dlls/kernel32/format_msg.c
@@ -154,6 +154,12 @@ DWORD WINAPI FormatMessageA(
         &&((dwFlags & FORMAT_MESSAGE_FROM_SYSTEM)
            || (dwFlags & FORMAT_MESSAGE_FROM_HMODULE))) return 0;
 
+    if (!lpBuffer)
+    {
+        SetLastError(ERROR_NOT_ENOUGH_MEMORY);
+        return 0;
+    }
+
     if (width && width != FORMAT_MESSAGE_MAX_WIDTH_MASK)
         FIXME("line wrapping (%u) not supported.\n", width);
     from = NULL;
@@ -368,6 +374,12 @@ DWORD WINAPI FormatMessageW(
         &&((dwFlags & FORMAT_MESSAGE_FROM_SYSTEM)
            || (dwFlags & FORMAT_MESSAGE_FROM_HMODULE))) return 0;
 
+    if (!lpBuffer)
+    {
+        SetLastError(ERROR_INVALID_PARAMETER);
+        return 0;
+    }
+
     if (width && width != FORMAT_MESSAGE_MAX_WIDTH_MASK)
         FIXME("line wrapping not supported.\n");
     from = NULL;
diff --git a/dlls/kernel32/tests/format_msg.c b/dlls/kernel32/tests/format_msg.c
index 9396d45973d..e7b012cb07e 100644
--- a/dlls/kernel32/tests/format_msg.c
+++ b/dlls/kernel32/tests/format_msg.c
@@ -220,7 +220,25 @@ static void test_message_from_string(void)
     ok(r==2,"failed: r=%d\n",r);
 }
 
+static void test_message_null_buffer(void)
+{
+    DWORD ret, error;
+
+    SetLastError(0xdeadbeef);
+    ret = FormatMessageA(FORMAT_MESSAGE_FROM_SYSTEM | FORMAT_MESSAGE_ALLOCATE_BUFFER, NULL, 0, 0, NULL, 0, NULL);
+    error = GetLastError();
+    ok(!ret, "FormatMessageA returned %u\n", ret);
+    ok(error == ERROR_NOT_ENOUGH_MEMORY, "last error %u\n", error);
+
+    SetLastError(0xdeadbeef);
+    ret = FormatMessageW(FORMAT_MESSAGE_FROM_SYSTEM | FORMAT_MESSAGE_ALLOCATE_BUFFER, NULL, 0, 0, NULL, 0, NULL);
+    error = GetLastError();
+    ok(!ret, "FormatMessageW returned %u\n", ret);
+    ok(error == ERROR_INVALID_PARAMETER, "last error %u\n", error);
+}
+
 START_TEST(format_msg)
 {
     test_message_from_string();
+    test_message_null_buffer();
 }
-- 
2.11.4.GIT