Jacek Caban : user32: Make sure that passed window handle is scroll control before accessing wExtra in SCROLL_GetInternalInfo.

[Alexandre Julliard]

Module: wine
Branch: master
Commit: b8ef42c9fd165da5c31d8f68f2ae39b77e9101f5
URL:    https://source.winehq.org/git/wine.git/?a=commit;h=b8ef42c9fd165da5c31d8f68f2ae39b77e9101f5

Author: Jacek Caban <jacek at codeweavers.com>
Date:   Thu Sep 20 16:48:55 2018 +0200

user32: Make sure that passed window handle is scroll control before accessing wExtra in SCROLL_GetInternalInfo.

Fixes memory corruption in Office 2016.

Signed-off-by: Jacek Caban <jacek at codeweavers.com>
Signed-off-by: Alexandre Julliard <julliard at winehq.org>

---

 dlls/user32/scroll.c       |  3 ++-
 dlls/user32/tests/scroll.c | 21 +++++++++++++++++++++
 2 files changed, 23 insertions(+), 1 deletion(-)

diff --git a/dlls/user32/scroll.c b/dlls/user32/scroll.c
index 1c127fb..30a0cd9 100644
--- a/dlls/user32/scroll.c
+++ b/dlls/user32/scroll.c
@@ -159,7 +159,8 @@ static SCROLLBAR_INFO *SCROLL_GetInternalInfo( HWND hwnd, INT nBar, BOOL alloc )
             if (wndPtr->pScroll) infoPtr = &((LPWINSCROLLBAR_INFO)wndPtr->pScroll)->vert;
             break;
         case SB_CTL:
-            infoPtr = (SCROLLBAR_INFO *)wndPtr->wExtra;
+            if (get_class_winproc( wndPtr->class ) == BUILTIN_WINPROC( WINPROC_SCROLLBAR ))
+                infoPtr = (SCROLLBAR_INFO *)wndPtr->wExtra;
             break;
         case SB_BOTH:
             WARN("with SB_BOTH\n");
diff --git a/dlls/user32/tests/scroll.c b/dlls/user32/tests/scroll.c
index 291d11a..c19607d 100644
--- a/dlls/user32/tests/scroll.c
+++ b/dlls/user32/tests/scroll.c
@@ -114,6 +114,14 @@ static void test_EnableScrollBar(void)
     ok( ret, "The scrollbar should be enabled.\n" );
     ok( IsWindowEnabled( hScroll ), "The scrollbar window should be enabled.\n" );
 
+    SetLastError( 0xdeadbeef );
+    ret = EnableScrollBar( mainwnd, SB_CTL, ESB_ENABLE_BOTH );
+    ok( !ret, "EnableScrollBar should fail.\n" );
+    todo_wine
+    ok( GetLastError() == ERROR_INVALID_PARAMETER
+        || broken(GetLastError() == 0xdeadbeef), /* winxp */
+        "GetLastError() = %u\n", GetLastError() );
+
     /* disable window, try to re-enable */
     ret = EnableWindow( hScroll, FALSE );
     ok( !ret, "got %d\n", ret );
@@ -170,6 +178,16 @@ static void test_SetScrollPos(void)
     ret = GetScrollPos( hScroll, SB_CTL);
     ok( ret == 30, "The position should not be equal to zero\n");
 
+    SetLastError( 0xdeadbeef );
+    ret = SetScrollPos( mainwnd, SB_CTL, 30, TRUE );
+    ok( !ret, "The position should not be set.\n" );
+    ok( GetLastError() == 0xdeadbeef, "GetLastError() = %u\n", GetLastError() );
+
+    SetLastError( 0xdeadbeef );
+    ret = GetScrollPos( mainwnd, SB_CTL );
+    ok( !ret, "The position should be equal to zero\n");
+    ok( GetLastError() == 0xdeadbeef, "GetLastError() = %u\n", GetLastError() );
+
     DestroyWindow(hScroll);
     DestroyWindow(mainwnd);
 }
@@ -192,6 +210,9 @@ static void test_ShowScrollBar(void)
     ret = ShowScrollBar( NULL, SB_CTL, TRUE );
     ok( !ret, "The ShowScrollBar() should failed.\n" );
 
+    ret = ShowScrollBar( mainwnd, SB_CTL, TRUE );
+    ok( ret, "The ShowScrollBar() should not fail.\n" );
+
     DestroyWindow(hScroll);
     DestroyWindow(mainwnd);
 }