[PATCH 1/1] uxtheme: Check DrawThemeEdge() content rectangle pointer.

[Zhiyi Zhang]

From: Zhiyi Zhang

Otherwise, applications that call DrawThemeEdge() with BF_ADJUST and a NULL content rectangle
pointer will crash.
---
 dlls/uxtheme/draw.c         |  8 +++++---
 dlls/uxtheme/tests/system.c | 33 +++++++++++++++++++++++++++++++++
 2 files changed, 38 insertions(+), 3 deletions(-)

diff --git a/dlls/uxtheme/draw.c b/dlls/uxtheme/draw.c
index 0d403dc9514..aa6a9f3bd5d 100644
--- a/dlls/uxtheme/draw.c
+++ b/dlls/uxtheme/draw.c
@@ -1495,7 +1495,7 @@ static HRESULT draw_diag_edge (HDC hdc, HTHEME theme, int part, int state,
     }

/* Adjust rectangle if asked */
-    if(uFlags & BF_ADJUST)
+    if(contentsRect && uFlags & BF_ADJUST)
     {
         *contentsRect = *rc;
         if(uFlags & BF_LEFT)   contentsRect->left   += add;
@@ -1647,7 +1647,7 @@ static HRESULT draw_rect_edge (HDC hdc, HTHEME theme, int part, int state,
             DeleteObject (br);
         }

-        if(uFlags & BF_ADJUST)
+        if(contentsRect && uFlags & BF_ADJUST)
             *contentsRect = InnerRect;
     }

@@ -1673,7 +1673,9 @@ HRESULT WINAPI DrawThemeEdge(HTHEME hTheme, HDC hdc, int iPartId,
                              int iStateId, const RECT *pDestRect, UINT uEdge,
                              UINT uFlags, RECT *pContentRect)
 {
-    TRACE("%d %d 0x%08x 0x%08x\n", iPartId, iStateId, uEdge, uFlags);
+    TRACE("%p %p %d %d %s 0x%08x 0x%08x %s\n", hTheme, hdc, iPartId, iStateId,
+          wine_dbgstr_rect(pDestRect), uEdge, uFlags, wine_dbgstr_rect(pContentRect));
+
     if(!hTheme)
         return E_HANDLE;

diff --git a/dlls/uxtheme/tests/system.c b/dlls/uxtheme/tests/system.c
index 9a6739e1c16..fcb72338f44 100644
--- a/dlls/uxtheme/tests/system.c
+++ b/dlls/uxtheme/tests/system.c
@@ -2765,6 +2765,38 @@ static void test_ShouldAppsUseDarkMode(void)
     ok(result == !light_theme, "Expected value %d, got %d\n", !light_theme, result);
 }

+static void test_DrawThemeEdge(void)
+{
+    HTHEME htheme;
+    HRESULT hr;
+    HWND hwnd;
+    RECT rect;
+    HDC hdc;
+
+    hwnd = CreateWindowA(WC_STATICA, "", WS_POPUP, 0, 0, 1, 1, 0, 0, 0, NULL);
+    ok(hwnd != NULL, "CreateWindowA failed, error %#lx.\n", GetLastError());
+    htheme = OpenThemeData(hwnd, L"Button");
+    if (!htheme)
+    {
+        skip("Theming is inactive.\n");
+        DestroyWindow(hwnd);
+        return;
+    }
+
+    hdc = GetDC(hwnd);
+
+    /* Test BF_ADJUST with NULL content rect pointer */
+    hr = DrawThemeEdge(htheme, hdc, BP_PUSHBUTTON, PBS_NORMAL, &rect, BF_ADJUST, BF_RIGHT, NULL);
+    ok(hr == S_OK, "Got unexpected hr %#lx.\n", hr);
+
+    hr = DrawThemeEdge(htheme, hdc, BP_PUSHBUTTON, PBS_NORMAL, &rect, BF_DIAGONAL | BF_ADJUST, BF_RIGHT, NULL);
+    ok(hr == S_OK, "Got unexpected hr %#lx.\n", hr);
+
+    ReleaseDC(hwnd, hdc);
+    CloseThemeData(htheme);
+    DestroyWindow(hwnd);
+}
+
 START_TEST(system)
 {
     ULONG_PTR ctx_cookie;
@@ -2793,6 +2825,7 @@ START_TEST(system)
     test_theme(FALSE);
     test_ShouldSystemUseDarkMode();
     test_ShouldAppsUseDarkMode();
+    test_DrawThemeEdge();

if (load_v6_module(&ctx_cookie, &ctx))
     {