From: Yuxuan Shui yshui@codeweavers.com
When page creation fails in PROPSHEET_SetCurSel, the dialog window is destroyed, which means the attached PropSheetInfo (psInfo) is freed. Because there is a call to PROPSHEET_SetCurSel in the handling of WM_INITDIAG, any use of psInfo thereafter could be invalid, which wasn't taken into account. --- dlls/comctl32/propsheet.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
diff --git a/dlls/comctl32/propsheet.c b/dlls/comctl32/propsheet.c index 96a35338648..18ccbd270b9 100644 --- a/dlls/comctl32/propsheet.c +++ b/dlls/comctl32/propsheet.c @@ -3009,7 +3009,9 @@ static INT_PTR PROPSHEET_PropertySheet(PropSheetInfo* psInfo, BOOL unicode) if (parent) EnableWindow(parent, FALSE); } bRet = PROPSHEET_CreateDialog(psInfo); - if(!psInfo->isModeless) + if (!IsWindow((HWND)bRet)) + bRet = 0; + else if(!psInfo->isModeless) bRet = do_loop(psInfo); return bRet; } @@ -3661,7 +3663,8 @@ PROPSHEET_DialogProc(HWND hwnd, UINT uMsg, WPARAM wParam, LPARAM lParam) idx = psInfo->active_page; psInfo->active_page = -1;
- PROPSHEET_SetCurSel(hwnd, idx, 1, psInfo->proppage[idx].hpage); + if (!PROPSHEET_SetCurSel(hwnd, idx, 1, psInfo->proppage[idx].hpage)) + return FALSE;
/* doing TCM_SETCURSEL seems to be needed even in case of PSH_WIZARD, * as some programs call TCM_GETCURSEL to get the current selection