Dylan Smith : richedit: Fixed bugs in handling unterminated nested tables in RTF.

[Alexandre Julliard]

Module: wine
Branch: master
Commit: fab258022e3a02557060aade0f6371918328b987
URL:    http://source.winehq.org/git/wine.git/?a=commit;h=fab258022e3a02557060aade0f6371918328b987

Author: Dylan Smith <dylan.ah.smith at gmail.com>
Date:   Thu Sep 11 14:16:45 2008 -0400

richedit: Fixed bugs in handling unterminated nested tables in RTF.

---

 dlls/riched20/editor.c |   25 ++++++++++++-------------
 dlls/riched20/reader.c |    2 --
 2 files changed, 12 insertions(+), 15 deletions(-)

diff --git a/dlls/riched20/editor.c b/dlls/riched20/editor.c
index 01ef9c1..1fe23cd 100644
--- a/dlls/riched20/editor.c
+++ b/dlls/riched20/editor.c
@@ -1461,8 +1461,6 @@ static LRESULT ME_StreamIn(ME_TextEditor *editor, DWORD format, EDITSTREAM *stre
   if (!invalidRTF && !inStream.editstream->dwError)
   {
     if (format & SF_RTF) {
-      ME_DisplayItem *para;
-
       /* setup the RTF parser */
       memset(&parser, 0, sizeof parser);
       RTFSetEditStream(&parser, &inStream);
@@ -1486,13 +1484,13 @@ static LRESULT ME_StreamIn(ME_TextEditor *editor, DWORD format, EDITSTREAM *stre
       RTFRead(&parser);
       RTFFlushOutputBuffer(&parser);
       if (!editor->bEmulateVersion10) { /* v4.1 */
-        if (parser.tableDef && parser.tableDef->tableRowStart)
+        if (parser.tableDef && parser.tableDef->tableRowStart &&
+            (parser.nestingLevel > 0 || parser.canInheritInTbl))
         {
           /* Delete any incomplete table row at the end of the rich text. */
           int nOfs, nChars;
           ME_DisplayItem *pCell;
-
-          para = parser.tableDef->tableRowStart;
+          ME_DisplayItem *para;
 
           parser.rtfMinor = rtfRow;
           /* Complete the table row before deleting it.
@@ -1501,14 +1499,14 @@ static LRESULT ME_StreamIn(ME_TextEditor *editor, DWORD format, EDITSTREAM *stre
            * will be added for this change to the current paragraph format. */
           if (parser.nestingLevel > 0)
           {
-            while (parser.nestingLevel--)
-              ME_RTFSpecialCharHook(&parser);
-          } else if (parser.canInheritInTbl) {
+            while (parser.nestingLevel > 1)
+              ME_RTFSpecialCharHook(&parser); /* Decrements nestingLevel */
+            para = parser.tableDef->tableRowStart;
             ME_RTFSpecialCharHook(&parser);
-          }
-          if (parser.tableDef && parser.tableDef->tableRowStart &&
-              para->member.para.nFlags & MEPF_ROWEND)
-          {
+          } else {
+            para = parser.tableDef->tableRowStart;
+            ME_RTFSpecialCharHook(&parser);
+            assert(para->member.para.nFlags & MEPF_ROWEND);
             para = para->member.para.next_para;
           }
           pCell = para->member.para.pCell;
@@ -1518,7 +1516,8 @@ static LRESULT ME_StreamIn(ME_TextEditor *editor, DWORD format, EDITSTREAM *stre
           nOfs = ME_GetCursorOfs(editor, 1);
           nChars = ME_GetCursorOfs(editor, 0) - nOfs;
           ME_InternalDeleteText(editor, nOfs, nChars, TRUE);
-          parser.tableDef->tableRowStart = NULL;
+          if (parser.tableDef)
+            parser.tableDef->tableRowStart = NULL;
         }
       }
       ME_CheckTablesForCorruption(editor);
diff --git a/dlls/riched20/reader.c b/dlls/riched20/reader.c
index c455c57..3d5593a 100644
--- a/dlls/riched20/reader.c
+++ b/dlls/riched20/reader.c
@@ -242,8 +242,6 @@ void RTFInit(RTF_Info *info)
 		info->cpOutputBuffer = heap_alloc(info->dwMaxCPOutputCount);
 	}
 
-        if (info->tableDef)
-            ZeroMemory(info->tableDef, sizeof(info->tableDef));
         info->tableDef = NULL;
         info->nestingLevel = 0;
         info->canInheritInTbl = FALSE;