[Bug 60495] New: NULL pointer crash in COMBOEX_NotifyEndEdit() when a ComboBoxEx item has empty/callback text

[WineHQ Bugzilla]

http://bugs.winehq.org/show_bug.cgi?id=60495

            Bug ID: 60495
           Summary: NULL pointer crash in COMBOEX_NotifyEndEdit() when a
                    ComboBoxEx item has empty/callback text
           Product: Wine
           Version: 11.19
          Hardware: x86-64
                OS: Linux
            Status: UNCONFIRMED
          Severity: critical
          Priority: P2
         Component: comctl32
          Assignee: [e-mail]
          Reporter: [e-mail]
  Target Milestone: ---
      Distribution: ---

Wine version: 11.19 (Staging) — also reproduced on 10.0 (Ubuntu repack)
OS: Linux (Ubuntu 26.04), WoW64
Affected app: AutoShop V4.11.0.5 (Inovance PLC programming software, 32-bit,
MFC 9.0 / VC90)

---
Description:

AutoShop.exe crashes with an unhandled EXCEPTION_ACCESS_VIOLATION (read
from address 0) whenever the user interacts with a ComboBoxEx dropdown
whose currently-selected item has NULL/empty text while the control is
in active-edit mode and the dropdown closes.

The crash is deterministic and 100% reproducible on this install. It
was captured via the app's own minidump (dbghelp.dll-based crash
handler) and resolved with winedbg against Wine's own debug info:

Backtrace (winedbg against AutoShop.exe's own .dmp crash dump):

=>0 0x7838f80e lstrcpynW+0x1c [include/winbase.h:2411] in comctl32
  1 0x7838f80e COMBOEX_NotifyEndEdit+0x2e [dlls/comctl32/comboex.c:226] in
comctl32
  2 0x7838e2f4 COMBOEX_Command+0x4e4 [dlls/comctl32/comboex.c:1131] in comctl32
  3 0x783911a5 COMBOEX_WindowProc+0x1265 [dlls/comctl32/comboex.c:2101] in
comctl32
  4 0x7a01a648 in user32 (+0xa648)
  ... (standard WndProc dispatch chain through user32 / mfc90u) ...

---
Root cause:

dlls/comctl32/comboex.c, COMBOEX_NotifyEndEdit() (line 222-236):

    static INT COMBOEX_NotifyEndEdit (const COMBOEX_INFO *infoPtr,
NMCBEENDEDITW *neew, LPCWSTR wstr)
    {
        if (infoPtr->NtfUnicode) {
            lstrcpynW(neew->szText, wstr, CBEMAXSTRLEN);   // line 226 —
crashes if wstr == NULL
            ...

Called from COMBOEX_Command(), line 1131:

            if (COMBOEX_NotifyEndEdit (infoPtr, &cbeend,
COMBOEX_GetText(infoPtr, item))) return 0;

COMBOEX_GetText() (line 291) returns item->pszText directly when it is
not LPSTR_TEXTCALLBACKW:

    static LPCWSTR COMBOEX_GetText(const COMBOEX_INFO *infoPtr, CBE_ITEMDATA
*item)
    {
        ...
        if (item->pszText != LPSTR_TEXTCALLBACKW)
            return item->pszText;
        ...

item->pszText is legitimately NULL when the item was inserted with an
empty string (InsertItemW only allocates pszText when the supplied
text has non-zero length). COMBOEX_NotifyEndEdit() never checks wstr
for NULL before handing it to lstrcpynW()/WideCharToMultiByte(), so
any item with empty text that is active-edited and then has its
dropdown closed (CBN_DROPDOWN path, oldflags & WCBE_ACTEDIT) crashes
the process.

---
Steps to reproduce:

1. Any app using a ComctlX ComboBoxEx control (CBS_DROPDOWN /
   WC_COMBOBOXEXW) that can insert an item with empty text
   (COMBOBOXEXITEMW.pszText = L"" or iImage-only item, cchTextMax 0).
2. Give the ComboBoxEx keyboard/edit focus (active-edit mode), then
   open and close its dropdown (e.g. click the dropdown arrow, or
   programmatically trigger CB_SHOWDROPDOWN) while that empty-text
   item is the current selection.
3. Wine crashes with STATUS_ACCESS_VIOLATION inside comctl32.

A minimal repro using raw Win32/ComCtl32 API (InsertItemW with an
empty pszText, then toggling the dropdown) should trigger it; I can
only confirm against the third-party app above, not against a
minimal test case, since I don't have a Windows machine to verify the
behavior differs from real Windows.

---
Suggested fix:

--- a/dlls/comctl32/comboex.c
+++ b/dlls/comctl32/comboex.c
@@ -222,6 +222,8 @@
 static INT COMBOEX_NotifyEndEdit (const COMBOEX_INFO *infoPtr, NMCBEENDEDITW
*neew, LPCWSTR wstr)
 {
+    if (!wstr) wstr = L"";
+
     /* Change the Text item from Unicode to ANSI if necessary for NOTIFY */
     if (infoPtr->NtfUnicode) {
        lstrcpynW(neew->szText, wstr, CBEMAXSTRLEN);

This mirrors how real Windows comctl32 appears to treat an empty-text
item (as an empty string, not a NULL dereference) — defensive NULL
handling at the single point where the untrusted text pointer enters
this function is the minimal, safe fix.

-- 
Do not reply to this email, post in Bugzilla using the
above URL to reply.
You are receiving this mail because:
You are watching all bug changes.