diff --git a/dlls/userenv/tests/userenv.c b/dlls/userenv/tests/userenv.c
index 446870f065c..c96b710a2c7 100644
--- a/dlls/userenv/tests/userenv.c
+++ b/dlls/userenv/tests/userenv.c
@@ -264,6 +264,23 @@ static void test_get_profiles_dir(void)
 
     HeapFree(GetProcessHeap(), 0, buf);
     HeapFree(GetProcessHeap(), 0, profiles_dir);
+
+    SetLastError(0xdeadbeef);
+    r = GetProfilesDirectoryW(NULL, NULL);
+    expect(FALSE, r);
+    expect_gle(ERROR_INVALID_PARAMETER);
+
+    cch = 0;
+    SetLastError(0xdeadbeef);
+    r = GetProfilesDirectoryW(NULL, &cch);
+    expect(FALSE, r);
+    expect_gle(ERROR_INSUFFICIENT_BUFFER);
+    ok(cch, "expected cch > 0\n");
+
+    SetLastError(0xdeadbeef);
+    r = GetProfilesDirectoryW(NULL, &cch);
+    expect(FALSE, r);
+    expect_gle(ERROR_INSUFFICIENT_BUFFER);
 }
 
 START_TEST(userenv)
diff --git a/dlls/userenv/userenv_main.c b/dlls/userenv/userenv_main.c
index 59b3b1f9546..42044722f5b 100644
--- a/dlls/userenv/userenv_main.c
+++ b/dlls/userenv/userenv_main.c
@@ -201,7 +201,7 @@ BOOL WINAPI GetProfilesDirectoryW( LPWSTR lpProfilesDir, LPDWORD lpcchSize )
 
     TRACE("%p %p\n", lpProfilesDir, lpcchSize );
 
-    if (!lpProfilesDir || !lpcchSize)
+    if (!lpcchSize)
     {
         SetLastError(ERROR_INVALID_PARAMETER);
         return FALSE;
@@ -234,7 +234,7 @@ BOOL WINAPI GetProfilesDirectoryW( LPWSTR lpProfilesDir, LPDWORD lpcchSize )
     }
     expanded_len = ExpandEnvironmentStringsW(unexpanded_profiles_dir, NULL, 0);
     /* The returned length doesn't include the NULL terminator. */
-    if (*lpcchSize < expanded_len - 1)
+    if (*lpcchSize < expanded_len - 1 || !lpProfilesDir)
     {
         *lpcchSize = expanded_len - 1;
         SetLastError(ERROR_INSUFFICIENT_BUFFER);