[Bug 55152] New: Crash in Notepad++ processing a WM_DRAWITEM message

[WineHQ Bugzilla]

https://bugs.winehq.org/show_bug.cgi?id=55152

Bug ID: 55152
           Summary: Crash in Notepad++ processing a WM_DRAWITEM message
           Product: Wine
           Version: 8.11
          Hardware: x86-64
                OS: Linux
            Status: NEW
          Severity: normal
          Priority: P2
         Component: win32u
          Assignee: [e-mail]
          Reporter: [e-mail]
      Distribution: ---

Running the 32-bit Notepad++ 8.5.4 in new wow64 mode crashes on startup when
processing a WM_DRAWITEM message. The exception is swallowed by win32u so it
still works, but we get a message:

0024:err:seh:KiUserCallbackDispatcher ignoring exception

The root cause is that because Notepad++ added a WH_CALLWNDPROC hook, in win32u
process_message(), instead of returning to SendMessageW and have it call the
winproc, we call it ourselves through KeUserModeCallback. But at that point the
message has been converted to 64-bit so we pass a (truncated) 64-bit lparam to
the 32-bit winproc.

The crash was revealed by a82238fad52761114ab2488d422fad3f70dbb854, which moves
the 64-bit stack to high memory. Previously the lparam pointer would fit in
32-bit which avoided the crash, but it would still point to a 64-bit
DRAWITEMSTRUCT.