From: Jacek Caban Subject: wininet: Fixed handling NULL buffer in INTERNET_OPTION_PROXY queries Message-Id: <50EB01E1.6090003@codeweavers.com> Date: Mon, 07 Jan 2013 18:12:01 +0100 --- dlls/wininet/internet.c | 4 ++-- dlls/wininet/tests/internet.c | 6 ++++++ 2 files changed, 8 insertions(+), 2 deletions(-) diff --git a/dlls/wininet/internet.c b/dlls/wininet/internet.c index e95070f..3f59017 100644 --- a/dlls/wininet/internet.c +++ b/dlls/wininet/internet.c @@ -821,7 +821,7 @@ static DWORD APPINFO_QueryOption(object_header_t *hdr, DWORD option, void *buffe proxyBytesRequired = (lstrlenW(ai->proxy) + 1) * sizeof(WCHAR); if (ai->proxyBypass) proxyBypassBytesRequired = (lstrlenW(ai->proxyBypass) + 1) * sizeof(WCHAR); - if (*size < sizeof(INTERNET_PROXY_INFOW) + proxyBytesRequired + proxyBypassBytesRequired) + if (!pi || *size < sizeof(INTERNET_PROXY_INFOW) + proxyBytesRequired + proxyBypassBytesRequired) { *size = sizeof(INTERNET_PROXY_INFOW) + proxyBytesRequired + proxyBypassBytesRequired; return ERROR_INSUFFICIENT_BUFFER; @@ -854,7 +854,7 @@ static DWORD APPINFO_QueryOption(object_header_t *hdr, DWORD option, void *buffe if (ai->proxyBypass) proxyBypassBytesRequired = WideCharToMultiByte(CP_ACP, 0, ai->proxyBypass, -1, NULL, 0, NULL, NULL); - if (*size < sizeof(INTERNET_PROXY_INFOA) + proxyBytesRequired + proxyBypassBytesRequired) + if (!pi || *size < sizeof(INTERNET_PROXY_INFOA) + proxyBytesRequired + proxyBypassBytesRequired) { *size = sizeof(INTERNET_PROXY_INFOA) + proxyBytesRequired + proxyBypassBytesRequired; return ERROR_INSUFFICIENT_BUFFER; diff --git a/dlls/wininet/tests/internet.c b/dlls/wininet/tests/internet.c index 4fb9e23..15a600c 100644 --- a/dlls/wininet/tests/internet.c +++ b/dlls/wininet/tests/internet.c @@ -164,6 +164,12 @@ static void test_InternetQueryOptionA(void) int retval; BOOL res; + SetLastError(0xdeadbeef); + len = 0xdeadbeef; + retval = InternetQueryOptionA(NULL, INTERNET_OPTION_PROXY, NULL, &len); + ok(!retval && GetLastError() == ERROR_INSUFFICIENT_BUFFER, "Got wrong error %x(%u)\n", retval, GetLastError()); + ok(len >= sizeof(INTERNET_PROXY_INFO) && len != 0xdeadbeef,"len = %u\n", len); + hinet = InternetOpenA(useragent,INTERNET_OPEN_TYPE_DIRECT,NULL,NULL, 0); ok((hinet != 0x0),"InternetOpen Failed\n");