From e92cca8df654109110c8e82a24b9c892c78b157a Mon Sep 17 00:00:00 2001
From: Andrew Nguyen <anguyen@codeweavers.com>
Date: Wed, 19 May 2010 22:25:54 -0500
Subject: [PATCH] urlmon: Validate URL and output pointer in CreateURLMoniker.

---
 dlls/urlmon/tests/url.c | 20 ++++++++++++++++++++
 dlls/urlmon/umon.c      |  6 ++++++
 2 files changed, 26 insertions(+)

diff --git a/dlls/urlmon/tests/url.c b/dlls/urlmon/tests/url.c
index 661bf6ee718..bf5e9fe0ab1 100644
--- a/dlls/urlmon/tests/url.c
+++ b/dlls/urlmon/tests/url.c
@@ -242,6 +242,26 @@ static void test_CreateURLMoniker(LPCWSTR url1, LPCWSTR url2)
     IMoniker *mon1 = NULL;
     IMoniker *mon2 = NULL;
 
+    hr = CreateURLMoniker(NULL, NULL, NULL);
+    ok(hr == E_INVALIDARG,
+       "Expected CreateURLMoniker to return E_INVALIDARG, got 0x%08x\n", hr);
+
+    mon1 = (IMoniker *)0xdeadbeef;
+    hr = CreateURLMoniker(NULL, NULL, &mon1);
+    ok(hr == E_INVALIDARG,
+       "Expected CreateURLMoniker to return E_INVALIDARG, got 0x%08x\n", hr);
+    ok(mon1 == NULL, "Expected the output pointer to be NULL, got %p\n", mon1);
+
+    hr = CreateURLMoniker(NULL, emptyW, NULL);
+    ok(hr == E_INVALIDARG,
+       "Expected CreateURLMoniker to return E_INVALIDARG, got 0x%08x\n", hr);
+
+    hr = CreateURLMoniker(NULL, emptyW, &mon1);
+    ok(hr == S_OK ||
+       broken(hr == MK_E_SYNTAX), /* IE5/IE5.01/IE6 SP2 */
+       "Expected CreateURLMoniker to return S_OK, got 0x%08x\n", hr);
+    if(mon1) IMoniker_Release(mon1);
+
     hr = CreateURLMoniker(NULL, url1, &mon1);
     ok(SUCCEEDED(hr), "failed to create moniker: 0x%08x\n", hr);
     if(SUCCEEDED(hr)) {
diff --git a/dlls/urlmon/umon.c b/dlls/urlmon/umon.c
index 5e6a8f6c21f..92e902fc75c 100644
--- a/dlls/urlmon/umon.c
+++ b/dlls/urlmon/umon.c
@@ -513,6 +513,12 @@ HRESULT WINAPI CreateURLMonikerEx(IMoniker *pmkContext, LPCWSTR szURL, IMoniker
 
     TRACE("(%p, %s, %p, %08x)\n", pmkContext, debugstr_w(szURL), ppmk, dwFlags);
 
+    if (ppmk)
+        *ppmk = NULL;
+
+    if (!szURL || !ppmk)
+        return E_INVALIDARG;
+
     if (dwFlags & URL_MK_UNIFORM) FIXME("ignoring flag URL_MK_UNIFORM\n");
 
     if(!(obj = alloc_moniker()))