Nikolay Sivov : comctl32/rebar: Fix invalid band index access.

[Alexandre Julliard]

Module: wine
Branch: oldstable
Commit: 3c249a2c63b97fdac8f58fd52fb1a9bab5561417
URL:    https://source.winehq.org/git/wine.git/?a=commit;h=3c249a2c63b97fdac8f58fd52...

Author: Nikolay Sivov 
Date:   Thu Nov 21 10:45:20 2019 +0300

comctl32/rebar: Fix invalid band index access.

Wine-Bug: https://bugs.winehq.org/show_bug.cgi?id=47991
Signed-off-by: Nikolay Sivov 
Signed-off-by: Alexandre Julliard 
(cherry picked from commit d6c0f9f22a7f8925a44b5c304dced749c442a5d8)
Signed-off-by: Michael Stefaniuc

---

dlls/comctl32/rebar.c       |  6 ++++--
 dlls/comctl32/tests/rebar.c | 21 ++++++++++++++++++++-
 2 files changed, 24 insertions(+), 3 deletions(-)

diff --git a/dlls/comctl32/rebar.c b/dlls/comctl32/rebar.c
index 20ce49b3f9..a8c9a78972 100644
--- a/dlls/comctl32/rebar.c
+++ b/dlls/comctl32/rebar.c
@@ -1294,8 +1294,8 @@ static int REBAR_SetBandsHeight(const REBAR_INFO *infoPtr, INT iBeginBand, INT i
     REBAR_BAND *lpBand;
     int yMaxHeight = 0;
     int yPos = yStart;
-    int row = REBAR_GetBand(infoPtr, iBeginBand)->iRow;
-    int i;
+    int row, i;
+
     for (i = iBeginBand; i < iEndBand; i = next_visible(infoPtr, i))
     {
         lpBand = REBAR_GetBand(infoPtr, i);
@@ -1304,6 +1304,8 @@ static int REBAR_SetBandsHeight(const REBAR_INFO *infoPtr, INT iBeginBand, INT i
     }
     TRACE("Bands [%d; %d) height: %d\n", iBeginBand, iEndBand, yMaxHeight);

+    row = iBeginBand < iEndBand ? REBAR_GetBand(infoPtr, iBeginBand)->iRow : 0;
+
     for (i = iBeginBand; i < iEndBand; i = next_visible(infoPtr, i))
     {
         lpBand = REBAR_GetBand(infoPtr, i);
diff --git a/dlls/comctl32/tests/rebar.c b/dlls/comctl32/tests/rebar.c
index 3b1be77497..6c82295d40 100644
--- a/dlls/comctl32/tests/rebar.c
+++ b/dlls/comctl32/tests/rebar.c
@@ -499,6 +499,7 @@ static void test_layout(void)
     REBARBANDINFOA rbi;
     HIMAGELIST himl;
     REBARINFO ri;
+    int count;

rbsize_results_init();

@@ -660,9 +661,27 @@ static void test_layout(void)
     SendMessageA(hRebar, RB_INSERTBANDA, -1, (LPARAM)&rbi);
     check_sizes();

-    rbsize_results_free();
     DestroyWindow(hRebar);
     pImageList_Destroy(himl);
+
+    /* One hidden band. */
+    hRebar = create_rebar_control();
+
+    rbi.cbSize = REBARBANDINFOA_V6_SIZE;
+    rbi.fMask = RBBIM_STYLE | RBBIM_SIZE | RBBIM_CHILDSIZE | RBBIM_CHILD;
+    rbi.fStyle = RBBS_HIDDEN;
+    rbi.cx = 200;
+    rbi.cxMinChild = 100;
+    rbi.cyMinChild = 30;
+    rbi.hwndChild = NULL;
+
+    SendMessageA(hRebar, RB_INSERTBANDA, -1, (LPARAM)&rbi);
+    count = SendMessageA(hRebar, RB_GETROWCOUNT, 0, 0);
+    ok(!count, "Unexpected row count %d.\n", count);
+
+    DestroyWindow(hRebar);
+
+    rbsize_results_free();
 }

#if 0       /* use this to generate more tests */