From 786e955d8ca78a22ae6b58552ca8e952ffdf6848 Mon Sep 17 00:00:00 2001
From: Michael Martin <michael.martin@reactos.org>
Date: Sun, 17 May 2009 11:31:58 +0000
Subject: [PATCH] - ReadEventLogA/ReadEventLogW: Check for lpBuffer for NULL
 and if so set nNumberOfBytesToRead to zero so that rpcrt4 does not access a
 NULL buffer.   Set pnBytesRead and pnMinNumberOfBytesNeeded variables prior
 to checking for failure and returning FALSE.   In preparation for
 implementation of EventLog.

svn path=/trunk/; revision=40953
---
 reactos/dll/win32/advapi32/service/eventlog.c | 26 ++++++++++++++-----
 1 file changed, 20 insertions(+), 6 deletions(-)

diff --git a/reactos/dll/win32/advapi32/service/eventlog.c b/reactos/dll/win32/advapi32/service/eventlog.c
index 775d9c9f18c..0f7c48b148d 100644
--- a/reactos/dll/win32/advapi32/service/eventlog.c
+++ b/reactos/dll/win32/advapi32/service/eventlog.c
@@ -632,6 +632,13 @@ ReadEventLogA(IN HANDLE hEventLog,
         hEventLog, dwReadFlags, dwRecordOffset, lpBuffer,
         nNumberOfBytesToRead, pnBytesRead, pnMinNumberOfBytesNeeded);
 
+    /* If buffer is NULL set nNumberOfBytesToRead to 0 to prevent rpcrt4 from
+       trying to access a null pointer */
+    if (!lpBuffer)
+    {
+        nNumberOfBytesToRead = 0;
+    }
+
     RpcTryExcept
     {
         Status = ElfrReadELA(hEventLog,
@@ -648,15 +655,15 @@ ReadEventLogA(IN HANDLE hEventLog,
     }
     RpcEndExcept;
 
+    *pnBytesRead = (DWORD)bytesRead;
+    *pnMinNumberOfBytesNeeded = (DWORD)minNumberOfBytesNeeded;
+
     if (!NT_SUCCESS(Status))
     {
         SetLastError(RtlNtStatusToDosError(Status));
         return FALSE;
     }
 
-    *pnBytesRead = (DWORD)bytesRead;
-    *pnMinNumberOfBytesNeeded = (DWORD)minNumberOfBytesNeeded;
-
     return TRUE;
 }
 
@@ -689,6 +696,13 @@ ReadEventLogW(IN HANDLE hEventLog,
         hEventLog, dwReadFlags, dwRecordOffset, lpBuffer,
         nNumberOfBytesToRead, pnBytesRead, pnMinNumberOfBytesNeeded);
 
+    /* If buffer is NULL set nNumberOfBytesToRead to 0 to prevent rpcrt4 from
+       trying to access a null pointer */
+    if (!lpBuffer)
+    {
+        nNumberOfBytesToRead = 0;
+    }
+
     RpcTryExcept
     {
         Status = ElfrReadELW(hEventLog,
@@ -705,15 +719,15 @@ ReadEventLogW(IN HANDLE hEventLog,
     }
     RpcEndExcept;
 
+    *pnBytesRead = (DWORD)bytesRead;
+    *pnMinNumberOfBytesNeeded = (DWORD)minNumberOfBytesNeeded;
+
     if (!NT_SUCCESS(Status))
     {
         SetLastError(RtlNtStatusToDosError(Status));
         return FALSE;
     }
 
-    *pnBytesRead = (DWORD)bytesRead;
-    *pnMinNumberOfBytesNeeded = (DWORD)minNumberOfBytesNeeded;
-
     return TRUE;
 }