Rémi Bernon : imm32: Avoid resizing IMCC to zero-size buffer.

[Alexandre Julliard]

Module: wine
Branch: master
Commit: 5911f36cfff1b48047042f2848b59a626258b29c
URL:    https://gitlab.winehq.org/wine/wine/-/commit/5911f36cfff1b48047042f2848b59a6...

Author: Rémi Bernon <rbernon(a)codeweavers.com>
Date:   Mon Jun 12 10:37:56 2023 +0200

imm32: Avoid resizing IMCC to zero-size buffer.

Wine-Bug: https://bugs.winehq.org/show_bug.cgi?id=55027

---

 dlls/imm32/ime.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/dlls/imm32/ime.c b/dlls/imm32/ime.c
index fa8e94acb21..b5c4fc5b2e1 100644
--- a/dlls/imm32/ime.c
+++ b/dlls/imm32/ime.c
@@ -366,7 +366,9 @@ static UINT ime_set_comp_string( HIMC himc, LPARAM lparam )
     if (!(ctx = ImmLockIMC( himc ))) return 0;
 
     count = ImeToAsciiEx( VK_PROCESSKEY, lparam, NULL, &buffer.list, 0, himc );
-    if (count >= buffer.uMsgCount)
+    if (!count)
+        TRACE( "ImeToAsciiEx returned no messages\n" );
+    else if (count >= buffer.uMsgCount)
         WARN( "ImeToAsciiEx returned %#x messages\n", count );
     else if (!(himcc = ImmReSizeIMCC( ctx->hMsgBuf, (ctx->dwNumMsgBuf + count) * sizeof(*msgs) )))
         WARN( "Failed to resize input context message buffer\n" );
@@ -534,7 +536,7 @@ UINT WINAPI ImeToAsciiEx( UINT vkey, UINT vsc, BYTE *state, TRANSMSGLIST *msgs,
 
     if (!(ctx = ImmLockIMC( himc ))) return 0;
     if (!(compstr = ImmLockIMCC( ctx->hCompStr ))) goto done;
-    size = compstr->dwSize;
+    size = max( compstr->dwSize, sizeof(COMPOSITIONSTRING) );
 
     do
     {