Nikolay Sivov : urlmon: Fix parameter validation in BindToStorage().

[Alexandre Julliard]

Module: wine
Branch: master
Commit: b26aa09f58d7f015a061e73db0b43ebbf6539fa1
URL:    http://source.winehq.org/git/wine.git/?a=commit;h=b26aa09f58d7f015a061e73db0...

Author: Nikolay Sivov 
Date:   Fri Apr  1 10:57:12 2011 +0400

urlmon: Fix parameter validation in BindToStorage().

---

dlls/urlmon/binding.c   |    4 +---
 dlls/urlmon/tests/url.c |   46 ++++++++++++++++++++++++++++++++++++++++++++++
 dlls/urlmon/umon.c      |    4 ++++
 3 files changed, 51 insertions(+), 3 deletions(-)

diff --git a/dlls/urlmon/binding.c b/dlls/urlmon/binding.c
index be72ee1..6f96dc0 100644
--- a/dlls/urlmon/binding.c
+++ b/dlls/urlmon/binding.c
@@ -907,7 +907,7 @@ static Binding *get_bctx_binding(IBindCtx *bctx)
     if(FAILED(hres))
         return NULL;

-    hres = IUnknown_QueryInterface(unk, &IID_IBinding, (void*)&binding);
+    hres = IUnknown_QueryInterface(unk, &IID_IBinding, (void**)&binding);
     IUnknown_Release(unk);
     if(FAILED(hres))
         return NULL;
@@ -1539,8 +1539,6 @@ HRESULT bind_to_storage(IUri *uri, IBindCtx *pbc, REFIID riid, void **ppv)
     Binding *binding = NULL, *binding_ctx;
     HRESULT hres;

-    *ppv = NULL;
-
     binding_ctx = get_bctx_binding(pbc);

hres = start_binding(NULL, binding_ctx, uri, pbc, FALSE, riid, &binding);
diff --git a/dlls/urlmon/tests/url.c b/dlls/urlmon/tests/url.c
index b606b90..6c1c7c6 100644
--- a/dlls/urlmon/tests/url.c
+++ b/dlls/urlmon/tests/url.c
@@ -308,7 +308,51 @@ static void test_CreateURLMoniker(LPCWSTR url1, LPCWSTR url2)

static void test_create(void)
 {
+    static const WCHAR relativeW[] = {'a','/','b','.','t','x','t',0};
+    IStream *stream;
+    IMoniker *mon;
+    IBindCtx *bctx;
+    HRESULT hr;
+
     test_CreateURLMoniker(TEST_URL_1, TEST_PART_URL_1);
+
+    mon = (void*)0xdeadbeef;
+    hr = CreateURLMoniker(NULL, relativeW, &mon);
+    ok(hr == S_OK, "got 0x%08x\n", hr);
+
+    hr = CreateBindCtx(0, &bctx);
+
+    stream = (void*)0xdeadbeef;
+    hr = IMoniker_BindToStorage(mon, bctx, NULL, &IID_IStream, (void**)&stream);
+    todo_wine ok(hr == INET_E_UNKNOWN_PROTOCOL, "got 0x%08x\n", hr);
+    ok(stream == NULL, "got %p\n", stream);
+
+    hr = IMoniker_BindToStorage(mon, bctx, NULL, &IID_IStream, NULL);
+    ok(hr == E_INVALIDARG, "got 0x%08x\n", hr);
+
+    stream = (void*)0xdeadbeef;
+    hr = IMoniker_BindToStorage(mon, NULL, NULL, &IID_IStream, (void**)&stream);
+    ok(hr == E_INVALIDARG, "got 0x%08x\n", hr);
+    ok(stream == NULL || broken(stream == (void*)0xdeadbeef) /* starting XP SP3 it's set to null */,
+        "got %p\n", stream);
+
+    IMoniker_Release(mon);
+
+    mon = (void*)0xdaedbeef;
+    hr = CreateURLMoniker(NULL, TEST_URL_1, &mon);
+    ok(hr == S_OK, "got 0x%08x\n", hr);
+
+    stream = (void*)0xdeadbeef;
+    hr = IMoniker_BindToStorage(mon, NULL, NULL, &IID_IStream, (void**)&stream);
+    ok(hr == E_INVALIDARG, "got 0x%08x\n", hr);
+    ok(stream == NULL || broken(stream == (void*)0xdeadbeef) /* starting XP SP3 it's set to null */,
+        "got %p\n", stream);
+
+    hr = IMoniker_BindToStorage(mon, bctx, NULL, &IID_IStream, NULL);
+    ok(hr == E_INVALIDARG, "got 0x%08x\n", hr);
+
+    IMoniker_Release(mon);
+    IBindCtx_Release(bctx);
 }

static HRESULT WINAPI Priority_QueryInterface(IInternetPriority *iface, REFIID riid, void **ppv)
@@ -3378,9 +3422,11 @@ static void test_BindToStorage_fail(void)
     hres = pCreateAsyncBindCtxEx(NULL, 0, NULL, NULL, &bctx, 0);
     ok(hres == S_OK, "CreateAsyncBindCtxEx failed: %08x\n", hres);

+    unk = (void*)0xdeadbeef;
     hres = IMoniker_BindToStorage(mon, bctx, NULL, &IID_IStream, (void**)&unk);
     ok(hres == MK_E_SYNTAX || hres == INET_E_DATA_NOT_AVAILABLE,
        "hres=%08x, expected MK_E_SYNTAX or INET_E_DATA_NOT_AVAILABLE\n", hres);
+    ok(unk == NULL, "got %p\n", unk);

IBindCtx_Release(bctx);

diff --git a/dlls/urlmon/umon.c b/dlls/urlmon/umon.c
index b13c9c3..8ef740f 100644
--- a/dlls/urlmon/umon.c
+++ b/dlls/urlmon/umon.c
@@ -237,6 +237,10 @@ static HRESULT WINAPI URLMoniker_BindToStorage(IMoniker* iface, IBindCtx* pbc,

TRACE("(%p)->(%p %p %s %p)\n", This, pbc, pmkToLeft, debugstr_guid(riid), ppvObject);

+    if(ppvObject) *ppvObject = NULL;
+
+    if(!pbc || !ppvObject) return E_INVALIDARG;
+
     if(pmkToLeft)
         FIXME("Unsupported pmkToLeft\n");