[PATCH 0/1] MR2966: comdlg32: Avoid crash in RemoveControlItem.

[Bernhard Übelacker]

Wine-Bug: https://bugs.winehq.org/show_bug.cgi?id=51640

First submission: https://www.winehq.org/pipermail/wine-devel/2021-December/202984.html

-- 
https://gitlab.winehq.org/wine/wine/-/merge_requests/2966

[PATCH 1/1] comdlg32: Avoid crash in RemoveControlItem.

[Bernhard Übelacker]

From: Bernhard Übelacker <bernhardu(a)mailbox.org>

Wine-Bug: https://bugs.winehq.org/show_bug.cgi?id=51640
---
 dlls/comdlg32/itemdlg.c       |  3 +++
 dlls/comdlg32/tests/itemdlg.c | 37 +++++++++++++++++++++++++++++++++++
 2 files changed, 40 insertions(+)

diff --git a/dlls/comdlg32/itemdlg.c b/dlls/comdlg32/itemdlg.c
index e6f4ecb55b9..f3b9a217e79 100644
--- a/dlls/comdlg32/itemdlg.c
+++ b/dlls/comdlg32/itemdlg.c
@@ -4159,6 +4159,9 @@ static HRESULT WINAPI IFileDialogCustomize_fnRemoveControlItem(IFileDialogCustom
 
         item = get_item(ctrl, dwIDItem, CDCS_VISIBLE|CDCS_ENABLED, &position);
 
+        if (!item)
+            return E_INVALIDARG;
+
         if ((item->cdcstate & (CDCS_VISIBLE|CDCS_ENABLED)) == (CDCS_VISIBLE|CDCS_ENABLED))
         {
             if(SendMessageW(ctrl->hwnd, CB_DELETESTRING, position, 0) == CB_ERR)
diff --git a/dlls/comdlg32/tests/itemdlg.c b/dlls/comdlg32/tests/itemdlg.c
index 9b4560fced8..8ce0ea806b9 100644
--- a/dlls/comdlg32/tests/itemdlg.c
+++ b/dlls/comdlg32/tests/itemdlg.c
@@ -2460,6 +2460,42 @@ static void test_overwrite(void)
     IShellItem_Release(psi_current);
 }
 
+static void test_customize_remove_from_empty_combobox(void)
+{
+    IFileDialog *pfod;
+    IFileDialogCustomize *pfdc;
+    UINT i;
+    HRESULT hr;
+    hr = CoCreateInstance(&CLSID_FileOpenDialog, NULL, CLSCTX_INPROC_SERVER,
+                          &IID_IFileDialog, (void**)&pfod);
+    ok(hr == S_OK, "got 0x%08lx.\n", hr);
+
+    hr = IFileDialog_QueryInterface(pfod, &IID_IFileDialogCustomize, (void**)&pfdc);
+    ok(hr == S_OK, "got 0x%08lx.\n", hr);
+    if(FAILED(hr))
+    {
+        skip("Skipping IFileDialogCustomize tests.\n");
+        IFileDialog_Release(pfod);
+        return;
+    }
+
+    i = 107;
+    hr = IFileDialogCustomize_AddComboBox(pfdc, i);
+    ok(hr == S_OK, "got 0x%08lx.\n", hr);
+
+    hr = IFileDialogCustomize_RemoveAllControlItems(pfdc, i);
+    ok(hr == E_NOTIMPL, "got 0x%08lx.\n", hr);
+
+    hr = IFileDialogCustomize_SetSelectedControlItem(pfdc, i, 1000);
+    ok(hr == E_INVALIDARG, "got 0x%08lx.\n", hr);
+
+    hr = IFileDialogCustomize_RemoveControlItem(pfdc, i, 0);
+    ok(hr == E_INVALIDARG, "got 0x%08lx.\n", hr);
+
+    IFileDialogCustomize_Release(pfdc);
+    IFileDialog_Release(pfod);
+}
+
 START_TEST(itemdlg)
 {
     OleInitialize(NULL);
@@ -2484,6 +2520,7 @@ START_TEST(itemdlg)
         test_customize();
         test_persistent_state();
         test_overwrite();
+        test_customize_remove_from_empty_combobox();
     }
     else
         skip("Skipping all Item Dialog tests.\n");
-- 
GitLab

https://gitlab.winehq.org/wine/wine/-/merge_requests/2966

[PATCH 0/1] MR2966: comdlg32: Avoid crash in RemoveControlItem. - approved

[Esme Povirk (＠madewokherd)]

This merge request was approved by Esme Povirk.
-- 
https://gitlab.winehq.org/wine/wine/-/merge_requests/2966