Nikolay Sivov : comctl32/tab: Fix reading out of array bounds on TCM_SETCURSEL.

[Alexandre Julliard]

Module: wine
Branch: master
Commit: 3371ba9f73367572693589905ed57af87b747b54
URL:    http://source.winehq.org/git/wine.git/?a=commit;h=3371ba9f73367572693589905e...

Author: Nikolay Sivov 
Date:   Thu Nov 19 21:05:14 2009 +0300

comctl32/tab: Fix reading out of array bounds on TCM_SETCURSEL.

---

dlls/comctl32/tab.c |   11 ++++++-----
 1 files changed, 6 insertions(+), 5 deletions(-)

diff --git a/dlls/comctl32/tab.c b/dlls/comctl32/tab.c
index 15534af..f8f9f5c 100644
--- a/dlls/comctl32/tab.c
+++ b/dlls/comctl32/tab.c
@@ -247,16 +247,17 @@ static inline LRESULT TAB_SetCurSel (TAB_INFO *infoPtr, INT iItem)
   TRACE("(%p %d)\n", infoPtr, iItem);

if (iItem < 0)
-      infoPtr->iSelected=-1;
+      infoPtr->iSelected = -1;
   else if (iItem >= infoPtr->uNumItem)
       return -1;
   else {
-      if (infoPtr->iSelected != iItem) {
-          TAB_GetItem(infoPtr, prevItem)->dwState &= ~TCIS_BUTTONPRESSED;
+      if (prevItem != iItem) {
+          if (prevItem != -1)
+              TAB_GetItem(infoPtr, prevItem)->dwState &= ~TCIS_BUTTONPRESSED;
           TAB_GetItem(infoPtr, iItem)->dwState |= TCIS_BUTTONPRESSED;

-          infoPtr->iSelected=iItem;
-          infoPtr->uFocus=iItem;
+          infoPtr->iSelected = iItem;
+          infoPtr->uFocus = iItem;
           TAB_EnsureSelectionVisible(infoPtr);
           TAB_InvalidateTabArea(infoPtr);
       }