From 5a7c633fabc1c1682352673216fbaa57f9eab231 Mon Sep 17 00:00:00 2001
From: Andrew Nguyen <anguyen@codeweavers.com>
Date: Mon, 3 Jan 2011 21:25:39 -0600
Subject: [PATCH] kernel32: Improve parameter validation for
 FillConsoleOutputCharacterW.

---
 dlls/kernel32/console.c       | 12 +++++--
 dlls/kernel32/tests/console.c | 67 +++++++++++++++++++++++++++++++++++
 2 files changed, 76 insertions(+), 3 deletions(-)

diff --git a/dlls/kernel32/console.c b/dlls/kernel32/console.c
index 2c310bdab07..d365df29daf 100644
--- a/dlls/kernel32/console.c
+++ b/dlls/kernel32/console.c
@@ -755,6 +755,14 @@ BOOL WINAPI FillConsoleOutputCharacterW( HANDLE hConsoleOutput, WCHAR ch, DWORD
     TRACE("(%p,%s,%d,(%dx%d),%p)\n",
           hConsoleOutput, debugstr_wn(&ch, 1), length, coord.X, coord.Y, lpNumCharsWritten);
 
+    if (!lpNumCharsWritten)
+    {
+        SetLastError(ERROR_INVALID_ACCESS);
+        return FALSE;
+    }
+
+    *lpNumCharsWritten = 0;
+
     SERVER_START_REQ( fill_console_output )
     {
         req->handle  = console_handle_unmap(hConsoleOutput);
@@ -765,9 +773,7 @@ BOOL WINAPI FillConsoleOutputCharacterW( HANDLE hConsoleOutput, WCHAR ch, DWORD
         req->data.ch = ch;
         req->count   = length;
         if ((ret = !wine_server_call_err( req )))
-        {
-            if (lpNumCharsWritten) *lpNumCharsWritten = reply->written;
-        }
+            *lpNumCharsWritten = reply->written;
     }
     SERVER_END_REQ;
     return ret;
diff --git a/dlls/kernel32/tests/console.c b/dlls/kernel32/tests/console.c
index 0ed73c094d1..112d7378842 100644
--- a/dlls/kernel32/tests/console.c
+++ b/dlls/kernel32/tests/console.c
@@ -1652,6 +1652,72 @@ static void test_WriteConsoleOutputAttribute(HANDLE output_handle)
     ok(count == 1, "Expected count to be 1, got %u\n", count);
 }
 
+static void test_FillConsoleOutputCharacterW(HANDLE output_handle)
+{
+    COORD origin = {0, 0};
+    DWORD count;
+    BOOL ret;
+    int i;
+
+    const struct
+    {
+        HANDLE hConsoleOutput;
+        WCHAR ch;
+        DWORD length;
+        COORD coord;
+        LPDWORD lpNumCharsWritten;
+        DWORD expected_count;
+        DWORD last_error;
+        int win7_crash;
+    } invalid_table[] =
+    {
+        {NULL, 'a', 0, origin, NULL, 0xdeadbeef, ERROR_INVALID_ACCESS, 1},
+        {NULL, 'a', 0, origin, &count, 0, ERROR_INVALID_HANDLE},
+        {NULL, 'a', 1, origin, NULL, 0xdeadbeef, ERROR_INVALID_ACCESS, 1},
+        {NULL, 'a', 1, origin, &count, 0, ERROR_INVALID_HANDLE},
+        {INVALID_HANDLE_VALUE, 'a', 0, origin, NULL, 0xdeadbeef, ERROR_INVALID_ACCESS, 1},
+        {INVALID_HANDLE_VALUE, 'a', 0, origin, &count, 0, ERROR_INVALID_HANDLE},
+        {INVALID_HANDLE_VALUE, 'a', 1, origin, NULL, 0xdeadbeef, ERROR_INVALID_ACCESS, 1},
+        {INVALID_HANDLE_VALUE, 'a', 1, origin, &count, 0, ERROR_INVALID_HANDLE},
+        {output_handle, 'a', 0, origin, NULL, 0xdeadbeef, ERROR_INVALID_ACCESS, 1},
+        {output_handle, 'a', 1, origin, NULL, 0xdeadbeef, ERROR_INVALID_ACCESS, 1},
+    };
+
+    for (i = 0; i < sizeof(invalid_table)/sizeof(invalid_table[0]); i++)
+    {
+        if (invalid_table[i].win7_crash)
+            continue;
+
+        SetLastError(0xdeadbeef);
+        if (invalid_table[i].lpNumCharsWritten) count = 0xdeadbeef;
+        ret = FillConsoleOutputCharacterW(invalid_table[i].hConsoleOutput,
+                                          invalid_table[i].ch,
+                                          invalid_table[i].length,
+                                          invalid_table[i].coord,
+                                          invalid_table[i].lpNumCharsWritten);
+        ok(!ret, "[%d] Expected FillConsoleOutputCharacterW to return FALSE, got %d\n", i, ret);
+        if (invalid_table[i].lpNumCharsWritten)
+        {
+            ok(count == invalid_table[i].expected_count,
+               "[%d] Expected count to be %u, got %u\n",
+               i, invalid_table[i].expected_count, count);
+        }
+        ok(GetLastError() == invalid_table[i].last_error,
+           "[%d] Expected last error to be %u, got %u\n",
+           i, invalid_table[i].last_error, GetLastError());
+    }
+
+    count = 0xdeadbeef;
+    ret = FillConsoleOutputCharacterW(output_handle, 'a', 0, origin, &count);
+    ok(ret == TRUE, "Expected FillConsoleOutputCharacterW to return TRUE, got %d\n", ret);
+    ok(count == 0, "Expected count to be 0, got %u\n", count);
+
+    count = 0xdeadbeef;
+    ret = FillConsoleOutputCharacterW(output_handle, 'a', 1, origin, &count);
+    ok(ret == TRUE, "Expected FillConsoleOutputCharacterW to return TRUE, got %d\n", ret);
+    ok(count == 1, "Expected count to be 1, got %u\n", count);
+}
+
 START_TEST(console)
 {
     HANDLE hConIn, hConOut;
@@ -1711,4 +1777,5 @@ START_TEST(console)
     test_WriteConsoleOutputCharacterA(hConOut);
     test_WriteConsoleOutputCharacterW(hConOut);
     test_WriteConsoleOutputAttribute(hConOut);
+    test_FillConsoleOutputCharacterW(hConOut);
 }