kernel32: Check for NULL output buffer in FormatMessage{A, W}.

dlls/kernel32/format_msg.c

@@ -154,6 +154,12 @@ DWORD WINAPI FormatMessageA(
         &&((dwFlags & FORMAT_MESSAGE_FROM_SYSTEM)
            || (dwFlags & FORMAT_MESSAGE_FROM_HMODULE))) return 0;
 
+    if (!lpBuffer)
+    {
+        SetLastError(ERROR_NOT_ENOUGH_MEMORY);
+        return 0;
+    }
+
     if (width && width != FORMAT_MESSAGE_MAX_WIDTH_MASK)
         FIXME("line wrapping (%u) not supported.\n", width);
     from = NULL;
@@ -368,6 +374,12 @@ DWORD WINAPI FormatMessageW(
         &&((dwFlags & FORMAT_MESSAGE_FROM_SYSTEM)
            || (dwFlags & FORMAT_MESSAGE_FROM_HMODULE))) return 0;
 
+    if (!lpBuffer)
+    {
+        SetLastError(ERROR_INVALID_PARAMETER);
+        return 0;
+    }
+
     if (width && width != FORMAT_MESSAGE_MAX_WIDTH_MASK)
         FIXME("line wrapping not supported.\n");
     from = NULL;

dlls/kernel32/tests/format_msg.c

@@ -220,7 +220,25 @@ static void test_message_from_string(void)
     ok(r==2,"failed: r=%d\n",r);
 }
 
+static void test_message_null_buffer(void)
+{
+    DWORD ret, error;
+
+    SetLastError(0xdeadbeef);
+    ret = FormatMessageA(FORMAT_MESSAGE_FROM_SYSTEM | FORMAT_MESSAGE_ALLOCATE_BUFFER, NULL, 0, 0, NULL, 0, NULL);
+    error = GetLastError();
+    ok(!ret, "FormatMessageA returned %u\n", ret);
+    ok(error == ERROR_NOT_ENOUGH_MEMORY, "last error %u\n", error);
+
+    SetLastError(0xdeadbeef);
+    ret = FormatMessageW(FORMAT_MESSAGE_FROM_SYSTEM | FORMAT_MESSAGE_ALLOCATE_BUFFER, NULL, 0, 0, NULL, 0, NULL);
+    error = GetLastError();
+    ok(!ret, "FormatMessageW returned %u\n", ret);
+    ok(error == ERROR_INVALID_PARAMETER, "last error %u\n", error);
+}
+
 START_TEST(format_msg)
 {
     test_message_from_string();
+    test_message_null_buffer();
 }