Cause of seemingly random crashes in wininet.dll?

I am getting crashes deep in wininet.dll. It crashed trying to read the zero memory location in HTTP_REQUEST_HANDLE_OBJECT::ReleaseConnection

Is this a bug in the actual DLL and not caused by improper usage?

wininet!HTTP_REQUEST_HANDLE_OBJECT::ReleaseConnection+0x60

wininet!HTTP_REQUEST_HANDLE_OBJECT::CloseConnection+0x84

wininet!HTTP_REQUEST_HANDLE_OBJECT::ReadData_Fsm+0x5e8

wininet!CFsm_ReadData::RunSM+0x2e

wininet!CFsm::Run+0x39

wininet!DoFsm+0x25

wininet!HTTP_REQUEST_HANDLE_OBJECT::ReadData+0x38

wininet!HTTP_REQUEST_HANDLE_OBJECT::HttpReadData_Fsm+0x43

wininet!CFsm_HttpReadData::RunSM+0x2e

wininet!CFsm::Run+0x39

wininet!DoFsm+0x25

wininet!HttpReadData+0x67

wininet!ReadFile_Fsm+0x2d

wininet!开发者_StackOverflow社区CFsm_ReadFile::RunSM+0x2b

wininet!CFsm::Run+0x39

wininet!DoFsm+0x25

wininet!InternetReadFile+0x3ca

The context is I am trying to download a file. I am calling

InternetReadFile (hFile, lpBuffer, dwNumberOfBytesToRead, lpdwNumberOfBytesRead);

The hFile HINTERNET handle seems fine (value is 0x00cc0024 which seems legit) the dwNumberOfBytesToRead is 20000.

My buffer size is 131000 which is fine too.

The thing is my code works 99.9999% of the time!

Check use of lpdwNumberOfBytesRead. It should be either

DWORD *lpdwNumberOfBytesRead = &someDWORDsomewhere;
InternetReadFile (..., lpdwNumberOfBytesRead);

or

DWORD NumBytes
InternetReadFile (..., &NumBytes);

I have a feeling you are doing the first method without setting the pointer variable somewhere valid.

I found the problem was in calling InternetCloseHandle in other threads with an already closed handle. Normally this just returns ERROR_INVALID_HANDLE but in some circumstances makes wininet crash either in InternetCloseHandle or as in this case.