Jinoh Kang (@iamahuman) commented about dlls/comctl32/commctrl.c:
ret = ichCurrent; break; case WB_RIGHT: - if (!lpch || ichCurrent < 0 || ichCurrent > cch) - { - if (cch > ret) - ret = cch; - break; - } + assert(lpch != NULL); + assert(ichCurrent >= 0); + assert(cch >= 0);
/* skip word */ - while (ichCurrent < cch && lpch[ichCurrent] && !IsDelimiter(lpch[ichCurrent])) + while (lpch[ichCurrent] && !IsDelimiter(lpch[ichCurrent]))
Are we sure `lpch` is always a NULL-terminated string? Even if it was, the caller can pass `cch` a value less than the length of the entire string. https://learn.microsoft.com/en-us/windows/win32/api/winuser/nc-winuser-editw... says nothing about NULL-terminated strings. I think `ichCurrent < cch` in each loop can be left as-is. -- https://gitlab.winehq.org/wine/wine/-/merge_requests/1977#note_21309