Cause of seemingly random crashes in wininet.dll?

Question

I am getting crashes deep in wininet.dll. It crashed trying to read the zero memory location in HTTP_REQUEST_HANDLE_OBJECT::ReleaseConnection

Is this a bug in the actual DLL and not caused by improper usage?

wininet!HTTP_REQUEST_HANDLE_OBJECT::ReleaseConnection+0x60
wininet!HTTP_REQUEST_HANDLE_OBJECT::CloseConnection+0x84
wininet!HTTP_REQUEST_HANDLE_OBJECT::ReadData_Fsm+0x5e8
wininet!CFsm_ReadData::RunSM+0x2e
wininet!CFsm::Run+0x39
wininet!DoFsm+0x25
wininet!HTTP_REQUEST_HANDLE_OBJECT::ReadData+0x38
wininet!HTTP_REQUEST_HANDLE_OBJECT::HttpReadData_Fsm+0x43
wininet!CFsm_HttpReadData::RunSM+0x2e
wininet!CFsm::Run+0x39
wininet!DoFsm+0x25
wininet!HttpReadData+0x67
wininet!ReadFile_Fsm+0x2d
wininet!CFsm_ReadFile::RunSM+0x2b
wininet!CFsm::Run+0x39
wininet!DoFsm+0x25
wininet!InternetReadFile+0x3ca

The context is I am trying to download a file. I am calling

InternetReadFile (hFile, lpBuffer, dwNumberOfBytesToRead, lpdwNumberOfBytesRead);

The hFile HINTERNET handle seems fine (value is 0x00cc0024 which seems legit) the dwNumberOfBytesToRead is 20000.

My buffer size is 131000 which is fine too.

The thing is my code works 99.9999% of the time!

Answer 1

Check use of lpdwNumberOfBytesRead. It should be either

DWORD *lpdwNumberOfBytesRead = &someDWORDsomewhere;
InternetReadFile (..., lpdwNumberOfBytesRead);

or

DWORD NumBytes
InternetReadFile (..., &NumBytes);

I have a feeling you are doing the first method without setting the pointer variable somewhere valid.

Answer 2

I found the problem was in calling InternetCloseHandle in other threads with an already closed handle. Normally this just returns ERROR_INVALID_HANDLE but in some circumstances makes wininet crash either in InternetCloseHandle or as in this case.