>From f7b412d5685eb66c8c312c608769c53439253623 Mon Sep 17 00:00:00 2001
From: Nikolay Sivov <nsivov@codeweavers.com>
Date: Mon, 19 Dec 2011 23:48:43 +0300
Subject: [PATCH 2/2] Fix parameter validation for CreateMRUListLazyA()

---
 dlls/comctl32/comctl32undoc.c |    3 +-
 dlls/comctl32/tests/mru.c     |   67 +++++++++++++++++++++++++---------------
 2 files changed, 43 insertions(+), 27 deletions(-)

diff --git a/dlls/comctl32/comctl32undoc.c b/dlls/comctl32/comctl32undoc.c
index cc59747..5892d76 100644
--- a/dlls/comctl32/comctl32undoc.c
+++ b/dlls/comctl32/comctl32undoc.c
@@ -777,8 +777,7 @@ HANDLE WINAPI CreateMRUListLazyA (const MRUINFOA *lpcml, DWORD dwParam2,
 
     /* Native does not check for a NULL lpcml */
 
-    if (lpcml->cbSize != sizeof(MRUINFOA) || !lpcml->hKey ||
-        IsBadStringPtrA(lpcml->lpszSubKey, -1))
+    if (!lpcml->hKey || IsBadStringPtrA(lpcml->lpszSubKey, -1))
 	return 0;
 
     mp = Alloc(sizeof(WINEMRULIST));
diff --git a/dlls/comctl32/tests/mru.c b/dlls/comctl32/tests/mru.c
index 7d239d7..86eddc0 100644
--- a/dlls/comctl32/tests/mru.c
+++ b/dlls/comctl32/tests/mru.c
@@ -447,12 +447,37 @@ static void test_MRUListA(void)
 
     /* FreeMRUList(NULL) crashes on Win98 OSR0 */
 }
+/*
+typedef struct tagMRUINFOA
+{
+    DWORD   cbSize;
+    UINT    uMax;
+    UINT    fFlags;
+    HKEY    hKey;
+    LPCSTR  lpszSubKey;
+    PROC    lpfnCompare;
+} MRUINFOA;
+*/
+typedef struct {
+    MRUINFOA mruA;
+    BOOL ret;
+} create_lazya_t;
+
+static const create_lazya_t create_lazyA[] = {
+    {{ sizeof(MRUINFOA) + 1, 0, 0, HKEY_CURRENT_USER, NULL, NULL }, FALSE },
+    {{ sizeof(MRUINFOA) - 1, 0, 0, HKEY_CURRENT_USER, NULL, NULL }, FALSE },
+    {{ sizeof(MRUINFOA) + 1, 0, 0, HKEY_CURRENT_USER, "WineTest", NULL }, TRUE },
+    {{ sizeof(MRUINFOA) - 1, 0, 0, HKEY_CURRENT_USER, "WineTest", NULL }, TRUE },
+    {{ sizeof(MRUINFOA), 0, 0, HKEY_CURRENT_USER, "WineTest", NULL }, TRUE },
+    {{ sizeof(MRUINFOA), 0, 0, HKEY_CURRENT_USER, NULL, NULL }, FALSE },
+    {{ sizeof(MRUINFOA), 0, 0, NULL, "WineTest", NULL }, FALSE },
+    {{ 0, 0, 0, NULL, "WineTest", NULL }, FALSE },
+    {{ 0, 0, 0, HKEY_CURRENT_USER, "WineTest", NULL }, TRUE }
+};
 
 static void test_CreateMRUListLazyA(void)
 {
-    HANDLE hMRU;
-    HKEY hKey;
-    MRUINFOA listA = { 0 };
+    int i;
 
     if (!pCreateMRUListLazyA || !pFreeMRUList)
     {
@@ -460,28 +485,20 @@ static void test_CreateMRUListLazyA(void)
         return;
     }
 
-    /* wrong size */
-    listA.cbSize = sizeof(listA) + 1;
-    hMRU = pCreateMRUListLazyA(&listA, 0, 0, 0);
-    ok(hMRU == NULL, "Expected NULL handle, got %p\n", hMRU);
-    listA.cbSize = 4;
-    hMRU = pCreateMRUListLazyA(&listA, 0, 0, 0);
-    ok(hMRU == NULL, "Expected NULL handle, got %p\n", hMRU);
-    /* NULL hKey */
-    listA.cbSize = sizeof(listA);
-    listA.hKey = NULL;
-    hMRU = pCreateMRUListLazyA(&listA, 0, 0, 0);
-    ok(hMRU == NULL, "Expected NULL handle, got %p\n", hMRU);
-    /* NULL subkey */
-    ok(!RegCreateKeyA(HKEY_CURRENT_USER, REG_TEST_KEYA, &hKey),
-       "Couldn't create test key \"%s\"\n", REG_TEST_KEYA);
-    listA.cbSize = sizeof(listA);
-    listA.hKey = hKey;
-    listA.lpszSubKey = NULL;
-    hMRU = pCreateMRUListLazyA(&listA, 0, 0, 0);
-    ok(hMRU == NULL || broken(hMRU != NULL), /* Win9x */
-       "Expected NULL handle, got %p\n", hMRU);
-    if (hMRU) pFreeMRUList(hMRU);
+    for (i = 0; i < sizeof(create_lazyA)/sizeof(create_lazya_t); i++)
+    {
+        const create_lazya_t *ptr = &create_lazyA[i];
+        HANDLE hMRU;
+
+        hMRU = pCreateMRUListLazyA((MRUINFOA*)&ptr->mruA, 0, 0, 0);
+        if (ptr->ret)
+        {
+            ok(hMRU != NULL, "%d: got %p\n", i, hMRU);
+            pFreeMRUList(hMRU);
+        }
+        else
+            ok(hMRU == NULL, "%d: got %p\n", i, hMRU);
+    }
 }
 
 static void test_EnumMRUList(void)
-- 
1.5.6.5

