comctl32: toolbar[2/3]: Don't execute TB_GETBUTTONINFO if cbSize is invalid (fixes bug #7957)

[Mikołaj Zalewski]

-------------- next part --------------
From 7b1cd52ed93cb922f51b14b00a59067b8dfaa3c1 Mon Sep 17 00:00:00 2001
From: =?utf-8?q?Miko=C5=82aj_Zalewski?= <mikolaj at zalewski.pl>
Date: Thu, 5 Apr 2007 12:25:43 +0200
Subject: [PATCH] comctl32: toolbar: Don't execute TB_GETBUTTONINFO if cbSize is invalid (fixes bug #7957)

---
 dlls/comctl32/tests/toolbar.c |   23 +++++++++++++++++++++++
 dlls/comctl32/toolbar.c       |   10 +++++++++-
 2 files changed, 32 insertions(+), 1 deletions(-)

diff --git a/dlls/comctl32/tests/toolbar.c b/dlls/comctl32/tests/toolbar.c
index 08ce4e0..33de44c 100644
--- a/dlls/comctl32/tests/toolbar.c
+++ b/dlls/comctl32/tests/toolbar.c
@@ -864,6 +864,28 @@ static void test_sizes(void)
     DestroyWindow(hToolbar);
 }
 
+static void test_getbuttoninfo()
+{
+    HWND hToolbar = NULL;
+    int i;
+
+    rebuild_toolbar_with_buttons(&hToolbar);
+    for (i = 0; i < 128; i++)
+    {
+        TBBUTTONINFO tbi;
+        int ret;
+		
+        tbi.cbSize = i;
+        tbi.dwMask = TBIF_BYINDEX | TBIF_COMMAND;
+        ret = (int)SendMessage(hToolbar, TB_GETBUTTONINFO, 0, (LPARAM)&tbi);
+        if (i == sizeof(TBBUTTONINFO)) {
+            compare(ret, 0, "%d");
+        } else {
+            compare(ret, -1, "%d");
+        }
+    }
+    DestroyWindow(hToolbar);
+}
 
 static void test_createtoolbarex()
 {
@@ -933,6 +955,7 @@ START_TEST(toolbar)
     test_add_string();
     test_hotitem();
     test_sizes();
+    test_getbuttoninfo();
     test_createtoolbarex();
 
     PostQuitMessage(0);
diff --git a/dlls/comctl32/toolbar.c b/dlls/comctl32/toolbar.c
index 8fcc764..3d158f7 100644
--- a/dlls/comctl32/toolbar.c
+++ b/dlls/comctl32/toolbar.c
@@ -3363,8 +3363,16 @@ TOOLBAR_GetButtonInfoT(HWND hwnd, WPARAM wParam, LPARAM lParam, BOOL bUnicode)
 
     if (lpTbInfo == NULL)
 	return -1;
-    if (lpTbInfo->cbSize < sizeof(TBBUTTONINFOA))
+
+    /* MSDN documents a iImageLabel field added in Vista but it is not present in
+     * the headers and tests shows that even with comctl 6 Vista accepts only the
+     * original TBBUTTONINFO size
+     */
+    if (lpTbInfo->cbSize != sizeof(TBBUTTONINFOW))
+    {
+        WARN("Invalid button size\n");
 	return -1;
+    }
 
     nIndex = TOOLBAR_GetButtonIndex (infoPtr, (INT)wParam,
 				     lpTbInfo->dwMask & 0x80000000);
-- 
1.4.4.2