Module: wine Branch: master Commit: 031c497a5a689a88d6aa9e6a92397291650955e8 URL: http://source.winehq.org/git/wine.git/?a=commit;h=031c497a5a689a88d6aa9e6a92...
Author: Nikolay Sivov bunglehead@gmail.com Date: Fri Aug 14 22:50:05 2009 +0400
comctl32/tab: Check destination pointer for NULL in TCM_GETITEM handler.
---
dlls/comctl32/tab.c | 2 ++ dlls/comctl32/tests/tab.c | 5 +++++ 2 files changed, 7 insertions(+), 0 deletions(-)
diff --git a/dlls/comctl32/tab.c b/dlls/comctl32/tab.c index 4b439b2..5c90883 100644 --- a/dlls/comctl32/tab.c +++ b/dlls/comctl32/tab.c @@ -2810,6 +2810,8 @@ TAB_GetItemT (TAB_INFO *infoPtr, INT iItem, LPTCITEMW tabItem, BOOL bUnicode)
TRACE("(%p,%d,%p,%s)\n", infoPtr, iItem, tabItem, bUnicode ? "true" : "false");
+ if (!tabItem) return FALSE; + if (iItem < 0 || iItem >= infoPtr->uNumItem) return FALSE;
diff --git a/dlls/comctl32/tests/tab.c b/dlls/comctl32/tests/tab.c index 5fc1577..9163f92 100644 --- a/dlls/comctl32/tests/tab.c +++ b/dlls/comctl32/tests/tab.c @@ -835,8 +835,13 @@ static void test_getters_setters(HWND parent_wnd, INT nTabs) /* Testing GetSet Item */ { TCITEM tcItem; + DWORD ret; char szText[32] = "New Label";
+ /* TCM_GETITEM with null dest pointer */ + ret = SendMessage(hTab, TCM_GETITEM, 0, (LPARAM)NULL); + expect(FALSE, ret); + flush_sequences(sequences, NUM_MSG_SEQUENCES);
tcItem.mask = TCIF_TEXT;