Bernhard Übelacker : comdlg32: Avoid crash in RemoveControlItem.

[Alexandre Julliard]

Module: wine
Branch: master
Commit: 345ca7e061061e5511af85a45931350acb3764d7
URL:    https://gitlab.winehq.org/wine/wine/-/commit/345ca7e061061e5511af85a45931350...

Author: Bernhard Übelacker <bernhardu(a)mailbox.org>
Date:   Fri Dec 10 00:50:46 2021 +0100

comdlg32: Avoid crash in RemoveControlItem.

Wine-Bug: https://bugs.winehq.org/show_bug.cgi?id=51640

---

 dlls/comdlg32/itemdlg.c       |  3 +++
 dlls/comdlg32/tests/itemdlg.c | 37 +++++++++++++++++++++++++++++++++++++
 2 files changed, 40 insertions(+)

diff --git a/dlls/comdlg32/itemdlg.c b/dlls/comdlg32/itemdlg.c
index e6f4ecb55b9..f3b9a217e79 100644
--- a/dlls/comdlg32/itemdlg.c
+++ b/dlls/comdlg32/itemdlg.c
@@ -4159,6 +4159,9 @@ static HRESULT WINAPI IFileDialogCustomize_fnRemoveControlItem(IFileDialogCustom
 
         item = get_item(ctrl, dwIDItem, CDCS_VISIBLE|CDCS_ENABLED, &position);
 
+        if (!item)
+            return E_INVALIDARG;
+
         if ((item->cdcstate & (CDCS_VISIBLE|CDCS_ENABLED)) == (CDCS_VISIBLE|CDCS_ENABLED))
         {
             if(SendMessageW(ctrl->hwnd, CB_DELETESTRING, position, 0) == CB_ERR)
diff --git a/dlls/comdlg32/tests/itemdlg.c b/dlls/comdlg32/tests/itemdlg.c
index 9b4560fced8..8ce0ea806b9 100644
--- a/dlls/comdlg32/tests/itemdlg.c
+++ b/dlls/comdlg32/tests/itemdlg.c
@@ -2460,6 +2460,42 @@ static void test_overwrite(void)
     IShellItem_Release(psi_current);
 }
 
+static void test_customize_remove_from_empty_combobox(void)
+{
+    IFileDialog *pfod;
+    IFileDialogCustomize *pfdc;
+    UINT i;
+    HRESULT hr;
+    hr = CoCreateInstance(&CLSID_FileOpenDialog, NULL, CLSCTX_INPROC_SERVER,
+                          &IID_IFileDialog, (void**)&pfod);
+    ok(hr == S_OK, "got 0x%08lx.\n", hr);
+
+    hr = IFileDialog_QueryInterface(pfod, &IID_IFileDialogCustomize, (void**)&pfdc);
+    ok(hr == S_OK, "got 0x%08lx.\n", hr);
+    if(FAILED(hr))
+    {
+        skip("Skipping IFileDialogCustomize tests.\n");
+        IFileDialog_Release(pfod);
+        return;
+    }
+
+    i = 107;
+    hr = IFileDialogCustomize_AddComboBox(pfdc, i);
+    ok(hr == S_OK, "got 0x%08lx.\n", hr);
+
+    hr = IFileDialogCustomize_RemoveAllControlItems(pfdc, i);
+    ok(hr == E_NOTIMPL, "got 0x%08lx.\n", hr);
+
+    hr = IFileDialogCustomize_SetSelectedControlItem(pfdc, i, 1000);
+    ok(hr == E_INVALIDARG, "got 0x%08lx.\n", hr);
+
+    hr = IFileDialogCustomize_RemoveControlItem(pfdc, i, 0);
+    ok(hr == E_INVALIDARG, "got 0x%08lx.\n", hr);
+
+    IFileDialogCustomize_Release(pfdc);
+    IFileDialog_Release(pfod);
+}
+
 START_TEST(itemdlg)
 {
     OleInitialize(NULL);
@@ -2484,6 +2520,7 @@ START_TEST(itemdlg)
         test_customize();
         test_persistent_state();
         test_overwrite();
+        test_customize_remove_from_empty_combobox();
     }
     else
         skip("Skipping all Item Dialog tests.\n");