[PATCH] user.exe16: InsertMenu16 updated to handle HBITMAPs which applications

[Martin Payne]

have incorrectly cast (LPSTR)hBitmap rather than (LPSTR)(LONG)hBitmap.

Tested on Fedora 26 x86.

Signed-off-by: Martin Payne 
---
 dlls/user.exe16/user.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/dlls/user.exe16/user.c b/dlls/user.exe16/user.c
index eac4a19d39..bc1ce0b5dd 100644
--- a/dlls/user.exe16/user.c
+++ b/dlls/user.exe16/user.c
@@ -2396,7 +2396,12 @@ BOOL16 WINAPI InsertMenu16( HMENU16 hMenu, UINT16 pos, UINT16 flags,
     if ((pos == (UINT16)-1) && (flags & MF_BYPOSITION)) pos32 = (UINT)-1;
     if (IS_MENU_STRING_ITEM(flags) && data)
         return InsertMenuA( HMENU_32(hMenu), pos32, flags, id, MapSL(data) );
-    return InsertMenuA( HMENU_32(hMenu), pos32, flags, id, (LPSTR)data );
+
+    /* If "data" is an HBITMAP, the high WORD will contain the application's DGROUP selector if the application cast
+       (LPSTR)hBitmap rather than (LPSTR)(LONG)hBitmap. This works ok in Win16 but results in an invalid handle in 32
+       bit code. Therefore the high WORD is masked off when "data" is an HBITMAP. */
+    return InsertMenuA( HMENU_32(hMenu), pos32, flags, id,
+                      ((flags & MF_BITMAP) == MF_BITMAP) ? (LPSTR)(data & 0xFFFF) : (LPSTR)data );
 }