shell32: Avoid leaks and add parameter checks in SHCreateShellFolderView[Ex].

[Thomas Faber]

-------------- next part --------------
From 1eb391cee1391347a6cc8347d170ec2897161b9b Mon Sep 17 00:00:00 2001
From: Thomas Faber <thomas.faber at reactos.org>
Date: Sun, 20 Oct 2013 13:46:16 +0200
Subject: shell32: Avoid leaks and add parameter checks in
 SHCreateShellFolderView[Ex].

---
 dlls/shell32/shellord.c        |   7 ++-
 dlls/shell32/tests/shlfolder.c | 108 +++++++++++++++++++++++++++++++++++++++++
 2 files changed, 113 insertions(+), 2 deletions(-)

diff --git a/dlls/shell32/shellord.c b/dlls/shell32/shellord.c
index 8da849f..56c9fe9 100644
--- a/dlls/shell32/shellord.c
+++ b/dlls/shell32/shellord.c
@@ -1104,12 +1104,12 @@ HRESULT WINAPI SHCreateShellFolderViewEx(
 	  psvcbi->pshf, psvcbi->pidl, psvcbi->pfnCallback,
 	  psvcbi->fvm, psvcbi->psvOuter);
 
+	*ppv = NULL;
 	psf = IShellView_Constructor(psvcbi->pshf);
 
 	if (!psf)
 	  return E_OUTOFMEMORY;
 
-	IShellView_AddRef(psf);
 	hRes = IShellView_QueryInterface(psf, &IID_IShellView, (LPVOID *)ppv);
 	IShellView_Release(psf);
 
@@ -2224,6 +2224,10 @@ HRESULT WINAPI SHCreateShellFolderView(const SFV_CREATE *pcsfv,
 	IShellView * psf;
 	HRESULT hRes;
 
+	*ppsv = NULL;
+	if (!pcsfv || pcsfv->cbSize != sizeof(*pcsfv))
+	  return E_INVALIDARG;
+
 	TRACE("sf=%p outer=%p callback=%p\n",
 	  pcsfv->pshf, pcsfv->psvOuter, pcsfv->psfvcb);
 
@@ -2232,7 +2236,6 @@ HRESULT WINAPI SHCreateShellFolderView(const SFV_CREATE *pcsfv,
 	if (!psf)
 	  return E_OUTOFMEMORY;
 
-	IShellView_AddRef(psf);
 	hRes = IShellView_QueryInterface(psf, &IID_IShellView, (LPVOID *)ppsv);
 	IShellView_Release(psf);
 
diff --git a/dlls/shell32/tests/shlfolder.c b/dlls/shell32/tests/shlfolder.c
index 169426e..90b4036 100644
--- a/dlls/shell32/tests/shlfolder.c
+++ b/dlls/shell32/tests/shlfolder.c
@@ -72,6 +72,8 @@ static HRESULT (WINAPI *pSHGetItemFromObject)(IUnknown*,REFIID,void**);
 static BOOL (WINAPI *pIsWow64Process)(HANDLE, PBOOL);
 static UINT (WINAPI *pGetSystemWow64DirectoryW)(LPWSTR, UINT);
 static HRESULT (WINAPI *pSHCreateDefaultContextMenu)(const DEFCONTEXTMENU*,REFIID,void**);
+static HRESULT (WINAPI *pSHCreateShellFolderView)(const SFV_CREATE *pcsfv, IShellView **ppsv);
+static HRESULT (WINAPI *pSHCreateShellFolderViewEx)(LPCSFV psvcbi, IShellView **ppv);
 
 static const char *debugstr_guid(REFIID riid)
 {
@@ -148,6 +150,8 @@ static void init_function_pointers(void)
     MAKEFUNC_ORD(ILCombine, 25);
     MAKEFUNC_ORD(ILFree, 155);
     MAKEFUNC_ORD(SHSimpleIDListFromPathAW, 162);
+    MAKEFUNC_ORD(SHCreateShellFolderViewEx, 174);
+    MAKEFUNC_ORD(SHCreateShellFolderView, 256);
 #undef MAKEFUNC_ORD
 
     /* test named exports */
@@ -4609,6 +4613,109 @@ static void test_SHCreateDefaultContextMenu(void)
     Cleanup();
 }
 
+static void test_SHCreateShellFolderView(void)
+{
+    HRESULT hr;
+    IShellView *psv;
+    SFV_CREATE sfvc;
+    CSFV csfv;
+    IShellFolder *desktop;
+    ULONG refCount;
+
+    if (!pSHCreateShellFolderView || !pSHCreateShellFolderViewEx)
+    {
+        win_skip("SHCreateShellFolderView or SHCreateShellFolderViewEx missing.\n");
+        return;
+    }
+
+    hr = SHGetDesktopFolder(&desktop);
+    ok(hr == S_OK, "got (0x%08x)\n", hr);
+    if (FAILED(hr))
+    {
+        skip("No desktop folder\n");
+        return;
+    }
+
+    if (0)
+    {
+        // crash on win7
+        pSHCreateShellFolderView(NULL, NULL);
+    }
+
+    psv = (void *)0xdeadbeef;
+    hr = pSHCreateShellFolderView(NULL, &psv);
+    ok(hr == E_INVALIDARG, "Got 0x%08x\n", hr);
+    ok(psv == NULL, "psv = %p\n", psv);
+
+    memset(&sfvc, 0, sizeof(sfvc));
+    psv = (void *)0xdeadbeef;
+    hr = pSHCreateShellFolderView(&sfvc, &psv);
+    ok(hr == E_INVALIDARG, "Got 0x%08x\n", hr);
+    ok(psv == NULL, "psv = %p\n", psv);
+
+    memset(&sfvc, 0, sizeof(sfvc));
+    sfvc.cbSize = sizeof(sfvc) - 1;
+    psv = (void *)0xdeadbeef;
+    hr = pSHCreateShellFolderView(&sfvc, &psv);
+    ok(hr == E_INVALIDARG, "Got 0x%08x\n", hr);
+    ok(psv == NULL, "psv = %p\n", psv);
+
+    memset(&sfvc, 0, sizeof(sfvc));
+    sfvc.cbSize = sizeof(sfvc) + 1;
+    psv = (void *)0xdeadbeef;
+    hr = pSHCreateShellFolderView(&sfvc, &psv);
+    ok(hr == E_INVALIDARG, "Got 0x%08x\n", hr);
+    ok(psv == NULL, "psv = %p\n", psv);
+
+    memset(&sfvc, 0, sizeof(sfvc));
+    sfvc.cbSize = sizeof(sfvc);
+    sfvc.pshf = desktop;
+    psv = (void *)0xdeadbeef;
+    hr = pSHCreateShellFolderView(&sfvc, &psv);
+    ok(hr == S_OK, "Got 0x%08x\n", hr);
+    ok(psv != NULL, "psv = %p\n", psv);
+    if (psv && psv != (void *)0xdeadbeef)
+    {
+        refCount = IShellView_Release(psv);
+        ok(refCount == 0, "refCount = %u\n", refCount);
+    }
+
+    if (0)
+    {
+        // crash on win7
+        pSHCreateShellFolderViewEx(NULL, NULL);
+        pSHCreateShellFolderViewEx(NULL, &psv);
+        pSHCreateShellFolderViewEx(&csfv, NULL);
+    }
+
+    memset(&csfv, 0, sizeof(csfv));
+    csfv.pshf = desktop;
+    psv = (void *)0xdeadbeef;
+    hr = pSHCreateShellFolderViewEx(&csfv, &psv);
+    ok(hr == S_OK, "Got 0x%08x\n", hr);
+    ok(psv != NULL, "psv = %p\n", psv);
+    if (psv && psv != (void *)0xdeadbeef)
+    {
+        refCount = IShellView_Release(psv);
+        ok(refCount == 0, "refCount = %u\n", refCount);
+    }
+
+    memset(&csfv, 0, sizeof(csfv));
+    csfv.cbSize = sizeof(csfv);
+    csfv.pshf = desktop;
+    psv = (void *)0xdeadbeef;
+    hr = pSHCreateShellFolderViewEx(&csfv, &psv);
+    ok(hr == S_OK, "Got 0x%08x\n", hr);
+    ok(psv != NULL, "psv = %p\n", psv);
+    if (psv && psv != (void *)0xdeadbeef)
+    {
+        refCount = IShellView_Release(psv);
+        ok(refCount == 0, "refCount = %u\n", refCount);
+    }
+
+    IShellFolder_Release(desktop);
+}
+
 START_TEST(shlfolder)
 {
     init_function_pointers();
@@ -4645,6 +4752,7 @@ START_TEST(shlfolder)
     test_ShellItemBindToHandler();
     test_ShellItemGetAttributes();
     test_SHCreateDefaultContextMenu();
+    test_SHCreateShellFolderView();
 
     OleUninitialize();
 }
-- 
1.7.11.msysgit.1