Rémi Bernon (@rbernon) commented about dlls/win32u/imm.c:
else { comp_len = wcslen( update->comp_str );
cursor_begin = LOWORD(update->cursor_pos);
cursor_end = HIWORD(update->cursor_pos);
if (cursor_begin > comp_len) cursor_begin = comp_len;
if (cursor_end > comp_len) cursor_end = comp_len;
if (cursor_end < cursor_begin) cursor_end = cursor_begin;
if (cursor_begin < 0 || cursor_end < 0) cursor_begin = cursor_end = -1; /* no cursor */
Can this ever happen? It doesn't look like the helper functions are handling negative cursor positions, maybe this can simply be dropped. Cursor variables could stay unsigned as well, the check with comp_len will enforce correct values.