Re: [PATCH v4 0/1] MR1977: comctl32: Fix PathWordBreakProc.

[Jinoh Kang (＠iamahuman)]

Jinoh Kang (@iamahuman) commented about dlls/comctl32/commctrl.c:
>          ret = ichCurrent;
>          break;
>      case WB_RIGHT:
> -
>        if (!lpch || ichCurrent < 0 || ichCurrent > cch)
> -
>        {
> -
>            if (cch > ret)
> -
>                ret = cch;
> -
>            break;
> -
>        }
> -
>        assert(lpch != NULL);
> -
>        assert(ichCurrent >= 0);
> -
>        assert(cch >= 0);
>
>        /* skip word */
> -
>        while (ichCurrent < cch && lpch[ichCurrent] && !IsDelimiter(lpch[ichCurrent]))
> -
>        while (lpch[ichCurrent] && !IsDelimiter(lpch[ichCurrent]))

Are we sure `lpch` is always a NULL-terminated string? Even if it was, the caller can pass `cch` a value less than the length of the entire string. https://learn.microsoft.com/en-us/windows/win32/api/winuser/nc-winuser-editw... says nothing about NULL-terminated strings.

I think `ichCurrent < cch` in each loop can be left as-is.