From: "谢威" <xiewei@linuxdeepin.com>
Subject: [1/2] shlwapi: Fix crash in wvnsprintfW when buffer or spec is NULL 
Message-Id: <tencent_3FBDA203600CC0715E22EA95@qq.com>
Date: Mon, 9 May 2016 15:24:11 +0800

Crashes on windows when buffer == NULL && maxlen > 0

<div>Crashes on windows when buffer == NULL &amp;&amp; maxlen &gt; 0</div><div><includetail><!--<![endif]--></includetail></div>

From 8e2df1a15c8c2603cda5330aed7d9fba7021b277 Mon Sep 17 00:00:00 2001
From: Wei Xie <xiewei@linuxdeepin.com>
Date: Mon, 9 May 2016 14:56:13 +0800
Subject: shlwapi: Fix crash in wvnsprintfW when buffer or spec is NULL

Signed-off-by: Wei Xie <xiewei@linuxdeepin.com>
---
 dlls/shlwapi/wsprintf.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/dlls/shlwapi/wsprintf.c b/dlls/shlwapi/wsprintf.c
index 6a36b6a..ceca82e 100644
--- a/dlls/shlwapi/wsprintf.c
+++ b/dlls/shlwapi/wsprintf.c
@@ -439,6 +439,9 @@ INT WINAPI wvnsprintfW( LPWSTR buffer, INT maxlen, LPCWSTR spec, __ms_va_list ar
 
     TRACE("%p %u %s\n", buffer, maxlen, debugstr_w(spec));
 
+    if (maxlen <= 0 || (spec == NULL && buffer != NULL))
+        return -1;
+
     while (*spec && (maxlen > 1))
     {
         if (*spec != '%') { *p++ = *spec++; maxlen--; continue; }

-- 
2.7.0