[Bug 17563] New: Crash when using TTM_GETTEXT + LPSTR_CALLBACK

http://bugs.winehq.org/show_bug.cgi?id=17563

Summary: Crash when using TTM_GETTEXT + LPSTR_CALLBACK
           Product: Wine
           Version: unspecified
          Platform: All
        OS/Version: All
            Status: UNCONFIRMED
          Severity: normal
          Priority: P2
         Component: comdlg32
        AssignedTo: [e-mail]
        ReportedBy: [e-mail]

Created an attachment (id=19718)
 --> (http://bugs.winehq.org/attachment.cgi?id=19718)
Test application: Pressing the button crashes the program under Wine (the text
shows correctly if you go over the button). Source included.

Any program crashes when the message TTM_GETTEXT is sent to a ToolTip that has
lpszText set to LPSTR_CALLBACK.

The problem seems to be in dlls/comctl32/tooltips.c, in the functions
TOOLTIPS_GetTextA and TOOLTIPS_GetTextW.

The crash happens when Wine tries to copy lpszText, which is 0xFFFFFFFF.

Test application included.