From 81edd2acfc8a98ea225412aa37a8a83303732ea4 Mon Sep 17 00:00:00 2001 From: Jacek Caban Date: Mon, 7 Jan 2013 18:12:01 +0100 Subject: [PATCH] wininet: Fixed handling NULL buffer in INTERNET_OPTION_PROXY queries. --- dlls/wininet/internet.c | 4 ++-- dlls/wininet/tests/internet.c | 6 ++++++ 2 files changed, 8 insertions(+), 2 deletions(-) diff --git a/dlls/wininet/internet.c b/dlls/wininet/internet.c index e95070f4ac9..3f590178135 100644 --- a/dlls/wininet/internet.c +++ b/dlls/wininet/internet.c @@ -821,7 +821,7 @@ static DWORD APPINFO_QueryOption(object_header_t *hdr, DWORD option, void *buffe proxyBytesRequired = (lstrlenW(ai->proxy) + 1) * sizeof(WCHAR); if (ai->proxyBypass) proxyBypassBytesRequired = (lstrlenW(ai->proxyBypass) + 1) * sizeof(WCHAR); - if (*size < sizeof(INTERNET_PROXY_INFOW) + proxyBytesRequired + proxyBypassBytesRequired) + if (!pi || *size < sizeof(INTERNET_PROXY_INFOW) + proxyBytesRequired + proxyBypassBytesRequired) { *size = sizeof(INTERNET_PROXY_INFOW) + proxyBytesRequired + proxyBypassBytesRequired; return ERROR_INSUFFICIENT_BUFFER; @@ -854,7 +854,7 @@ static DWORD APPINFO_QueryOption(object_header_t *hdr, DWORD option, void *buffe if (ai->proxyBypass) proxyBypassBytesRequired = WideCharToMultiByte(CP_ACP, 0, ai->proxyBypass, -1, NULL, 0, NULL, NULL); - if (*size < sizeof(INTERNET_PROXY_INFOA) + proxyBytesRequired + proxyBypassBytesRequired) + if (!pi || *size < sizeof(INTERNET_PROXY_INFOA) + proxyBytesRequired + proxyBypassBytesRequired) { *size = sizeof(INTERNET_PROXY_INFOA) + proxyBytesRequired + proxyBypassBytesRequired; return ERROR_INSUFFICIENT_BUFFER; diff --git a/dlls/wininet/tests/internet.c b/dlls/wininet/tests/internet.c index 4fb9e23e7ed..15a600cda99 100644 --- a/dlls/wininet/tests/internet.c +++ b/dlls/wininet/tests/internet.c @@ -164,6 +164,12 @@ static void test_InternetQueryOptionA(void) int retval; BOOL res; + SetLastError(0xdeadbeef); + len = 0xdeadbeef; + retval = InternetQueryOptionA(NULL, INTERNET_OPTION_PROXY, NULL, &len); + ok(!retval && GetLastError() == ERROR_INSUFFICIENT_BUFFER, "Got wrong error %x(%u)\n", retval, GetLastError()); + ok(len >= sizeof(INTERNET_PROXY_INFO) && len != 0xdeadbeef,"len = %u\n", len); + hinet = InternetOpenA(useragent,INTERNET_OPEN_TYPE_DIRECT,NULL,NULL, 0); ok((hinet != 0x0),"InternetOpen Failed\n");