Alexander Kochetkov : user32: Fix arithmetic overflow in GetThumbVal.

[Alexandre Julliard]

Module: wine
Branch: master
Commit: 8037de9f020d58b9072fa44620df5a60f4ec5e58
URL:    http://source.winehq.org/git/wine.git/?a=commit;h=8037de9f020d58b9072fa44620df5a60f4ec5e58

Author: Alexander Kochetkov <al.kochet at gmail.com>
Date:   Sat Jan  9 15:24:44 2010 +0300

user32: Fix arithmetic overflow in GetThumbVal.

---

 dlls/user32/scroll.c |   10 +++++++---
 1 files changed, 7 insertions(+), 3 deletions(-)

diff --git a/dlls/user32/scroll.c b/dlls/user32/scroll.c
index 6c34652..423dea1 100644
--- a/dlls/user32/scroll.c
+++ b/dlls/user32/scroll.c
@@ -317,6 +317,7 @@ static UINT SCROLL_GetThumbVal( SCROLLBAR_INFO *infoPtr, RECT *rect,
 {
     INT thumbSize;
     INT pixels = vertical ? rect->bottom-rect->top : rect->right-rect->left;
+    INT range;
 
     if ((pixels -= 2*(GetSystemMetrics(SM_CXVSCROLL) - SCROLL_ARROW_THUMB_OVERLAP)) <= 0)
         return infoPtr->minVal;
@@ -333,9 +334,12 @@ static UINT SCROLL_GetThumbVal( SCROLLBAR_INFO *infoPtr, RECT *rect,
     pos = max( 0, pos - (GetSystemMetrics(SM_CXVSCROLL) - SCROLL_ARROW_THUMB_OVERLAP) );
     if (pos > pixels) pos = pixels;
 
-    if (!infoPtr->page) pos *= infoPtr->maxVal - infoPtr->minVal;
-    else pos *= infoPtr->maxVal - infoPtr->minVal - infoPtr->page + 1;
-    return infoPtr->minVal + ((pos + pixels / 2) / pixels);
+    if (!infoPtr->page)
+        range = infoPtr->maxVal - infoPtr->minVal;
+    else
+        range = infoPtr->maxVal - infoPtr->minVal - infoPtr->page + 1;
+
+    return infoPtr->minVal + MulDiv(pos, range, pixels);
 }
 
 /***********************************************************************