Fixed handling of NULL pointer in PeekMessageW, with test (reported by

Eric Frias).

diff --git a/dlls/user/message.c b/dlls/user/message.c
index 33debaf3c82a667159ca207a5e519a60359371c4..d21c40da4def5277aab6079afc29b1e8b2e341de 100644 (file)
--- a/dlls/user/message.c
+++ b/dlls/user/message.c
@@ -2296,6 +2296,11 @@ BOOL WINAPI PeekMessageW( MSG *msg_out, HWND hwnd, UINT first, UINT last, UINT f
      * msg_out is a variable from the *program*, so it can't be used
      * internally as it can get "corrupted" by our use of SendMessage()
      * (back to the program) inside the message handling itself. */
+    if (!msg_out)
+    {
+        SetLastError( ERROR_NOACCESS );
+        return FALSE;
+    }
     *msg_out = msg;
     return TRUE;
 }

diff --git a/dlls/user/tests/msg.c b/dlls/user/tests/msg.c
index 2146b53119ce387539e460b5331071394784facf..61ba06a37e4db83d0fc65742b78a4a3cb1a0c293 100644 (file)
--- a/dlls/user/tests/msg.c
+++ b/dlls/user/tests/msg.c
@@ -2280,6 +2280,7 @@ static void test_messages(void)
     HWND hwnd, hparent, hchild;
     HWND hchild2, hbutton;
     HMENU hmenu;
+    MSG msg;
 
     hwnd = CreateWindowExA(0, "TestWindowClass", "Test overlapped", WS_OVERLAPPEDWINDOW,
                            100, 100, 200, 200, 0, 0, 0, NULL);
@@ -2539,6 +2540,17 @@ static void test_messages(void)
     EnableWindow(hparent, FALSE);
     ok_sequence(WmEnableWindowSeq, "EnableWindow", FALSE);
 
+    while (PeekMessage( &msg, 0, 0, 0, PM_REMOVE )) DispatchMessage( &msg );
+    flush_sequence();
+    PostMessage( hparent, WM_USER, 0, 0 );
+    PostMessage( hparent, WM_USER+1, 0, 0 );
+    /* PeekMessage(NULL) fails, but still removes the message */
+    SetLastError(0xdeadbeef);
+    ok( !PeekMessage( NULL, 0, 0, 0, PM_REMOVE ), "PeekMessage(NULL) should fail\n" );
+    ok( GetLastError() == ERROR_NOACCESS, "last error is %ld\n", GetLastError() );
+    ok( PeekMessage( &msg, 0, 0, 0, PM_REMOVE ), "PeekMessage should succeed\n" );
+    ok( msg.message == WM_USER+1, "got %x instead of WM_USER+1\n", msg.message );
+
     DestroyWindow(hchild);
     DestroyWindow(hparent);
     flush_sequence();