From f8f208ff68e624d3841b0b6f4aade3afd96930d0 Mon Sep 17 00:00:00 2001
From: Daniel Lehman <dlehman@esri.com>
Date: Fri, 6 Jan 2012 10:48:44 -0800
Subject: kernel32: if string arg to FormatMessage is NULL, use "(null)" instead of crashing

---
 dlls/kernel32/format_msg.c       |   12 +++++++++---
 dlls/kernel32/tests/format_msg.c |   13 +++++++++++++
 2 files changed, 22 insertions(+), 3 deletions(-)

diff --git a/dlls/kernel32/format_msg.c b/dlls/kernel32/format_msg.c
index d6d19ff..7743ef1 100644
--- a/dlls/kernel32/format_msg.c
+++ b/dlls/kernel32/format_msg.c
@@ -137,14 +137,20 @@ static LPCWSTR format_insert( BOOL unicode_caller, int insert, LPCWSTR format,
         arg = get_arg( insert, flags, args );
         if (unicode_caller)
         {
-            WCHAR *str = (WCHAR *)arg;
+            static const WCHAR nullW[] = {'(','n','u','l','l',')',0};
+            const WCHAR *str = (const WCHAR *)arg;
+
+            if (!str) str = nullW;
             *result = HeapAlloc( GetProcessHeap(), 0, (strlenW(str) + 1) * sizeof(WCHAR) );
             strcpyW( *result, str );
         }
         else
         {
-            char *str = (char *)arg;
-            DWORD length = MultiByteToWideChar( CP_ACP, 0, str, -1, NULL, 0 );
+            const char *str = (const char *)arg;
+            DWORD length;
+
+            if (!str) str = "(null)";
+            length = MultiByteToWideChar( CP_ACP, 0, str, -1, NULL, 0 );
             *result = HeapAlloc( GetProcessHeap(), 0, length * sizeof(WCHAR) );
             MultiByteToWideChar( CP_ACP, 0, str, -1, *result, length );
         }
diff --git a/dlls/kernel32/tests/format_msg.c b/dlls/kernel32/tests/format_msg.c
index 37ea3e9..1f56440 100644
--- a/dlls/kernel32/tests/format_msg.c
+++ b/dlls/kernel32/tests/format_msg.c
@@ -125,6 +125,7 @@ static void test_message_from_string_wide(void)
     static const WCHAR s_sp002sp001[] = {' ',' ','0','0','0','2',',',' ',' ','0','0','1',0};
     static const WCHAR s_sp002sp003[] = {' ',' ','0','0','0','2',',',' ','0','0','0','0','3',0};
     static const WCHAR s_sp001004[]   = {' ',' ','0','0','1',',','0','0','0','0','0','4',0};
+    static const WCHAR s_null[]       = {'(','n','u','l','l',')',0};
 
     static const WCHAR init_buf[] = {'x', 'x', 'x', 'x', 'x', 'x'};
     static const WCHAR broken_buf[] = {'t','e','s','t','x','x'};
@@ -381,6 +382,12 @@ static void test_message_from_string_wide(void)
     ok(!lstrcmpW(s_crlfcrlf, out), "failed out=%s\n", wine_dbgstr_w(out));
     ok(r==4,"failed: r=%d\n", r);
 
+    /* null string as argument */
+    r = doitW(FORMAT_MESSAGE_FROM_STRING, fmt_1, 0,
+        0, out, sizeof(out)/sizeof(WCHAR), NULL);
+    ok(!lstrcmpW(s_null, out),"failed out=[%s]\n", wine_dbgstr_w(out));
+    ok(r==6,"failed: r=%d\n",r);
+
     /* precision and width */
 
     r = doitW(FORMAT_MESSAGE_FROM_STRING, fmt_13s,
@@ -700,6 +707,12 @@ static void test_message_from_string(void)
     ok(!strcmp("\r\n\r\n", out),"failed out=[%s]\n",out);
     ok(r==4,"failed: r=%d\n",r);
 
+    /* null string as argument */
+    r = doit(FORMAT_MESSAGE_FROM_STRING, "%1", 0,
+        0, out, sizeof(out)/sizeof(CHAR), NULL);
+    ok(!strcmp("(null)", out),"failed out=[%s]\n",out);
+    ok(r==6,"failed: r=%d\n",r);
+
     /* precision and width */
 
     r = doit(FORMAT_MESSAGE_FROM_STRING, "%1!3s!",
-- 
1.6.0.4