From 56784f60c16046f995b34ed67432525f0c6e18b5 Mon Sep 17 00:00:00 2001
From: Jeff Latimer <lats@yless4u.com.au>
Date: Wed, 14 Jan 2009 18:29:18 +1100
Subject: [PATCH] user32: Check for NULL pData in DdeClientTransAction
 expecting to be passed a handle.

---
 dlls/user32/dde_client.c | 18 ++++++++++++------
 dlls/user32/tests/dde.c  |  5 +----
 2 files changed, 13 insertions(+), 10 deletions(-)

diff --git a/dlls/user32/dde_client.c b/dlls/user32/dde_client.c
index d8a30c9515e..c052b83a45f 100644
--- a/dlls/user32/dde_client.c
+++ b/dlls/user32/dde_client.c
@@ -632,6 +632,15 @@ static WDML_XACT*	WDML_ClientQueueExecute(WDML_CONV* pConv, LPVOID pData, DWORD
 
     TRACE("XTYP_EXECUTE transaction\n");
 
+    if (pData == NULL)
+    {
+        if (cbData == (DWORD)-1)
+            pConv->instance->lastError = DMLERR_INVALIDPARAMETER;
+        else
+            pConv->instance->lastError = DMLERR_MEMORY_ERROR;
+        return NULL;
+    }
+
     pXAct = WDML_AllocTransaction(pConv->instance, WM_DDE_EXECUTE, 0, 0);
     if (!pXAct)
 	return NULL;
@@ -1154,13 +1163,10 @@ HDDEDATA WINAPI DdeClientTransaction(LPBYTE pData, DWORD cbData, HCONV hConv, HS
     switch (wType)
     {
     case XTYP_EXECUTE:
-        /* Windows simply ignores hszItem and wFmt in this case */
-	if (pData == NULL)
-	{
-	    pConv->instance->lastError = DMLERR_INVALIDPARAMETER;
-	    return 0;
-	}
+    /* Windows simply ignores hszItem and wFmt in this case */
 	pXAct = WDML_ClientQueueExecute(pConv, pData, cbData);
+	if (pXAct == NULL)
+	    return 0;
 	break;
     case XTYP_POKE:
         if (!hszItem)
diff --git a/dlls/user32/tests/dde.c b/dlls/user32/tests/dde.c
index 0ece009273f..e1ccf662ba5 100644
--- a/dlls/user32/tests/dde.c
+++ b/dlls/user32/tests/dde.c
@@ -427,10 +427,7 @@ todo_wine
     ret = DdeGetLastError(client_pid);
     ok(op == NULL, "Expected NULL, got %p\n", op);
     ok(res == 0xdeadbeef, "Expected 0xdeadbeef, got %d\n", res);
-    todo_wine
-    {
-        ok(ret == DMLERR_MEMORY_ERROR, "Expected DMLERR_MEMORY_ERROR, got %d\n", ret);
-    }
+    ok(ret == DMLERR_MEMORY_ERROR, "Expected DMLERR_MEMORY_ERROR, got %d\n", ret);
 
     /* XTYP_EXECUTE, no data, -1 size */
     res = 0xdeadbeef;