[PATCH 2/2] user32: Don't send WM_GETTEXT from GetWindowText() with invalid buffer length

[Nikolay Sivov]

---

-------------- next part --------------
>From e17aedefbd9a091e6e3e8fbcb051e9d5b883d2a7 Mon Sep 17 00:00:00 2001
From: Nikolay Sivov <nsivov at codeweavers.com>
Date: Thu, 23 Jul 2015 21:33:37 +0300
Subject: [PATCH 2/2] user32: Don't send WM_GETTEXT from GetWindowText() with
 invalid buffer length

---
 dlls/user32/tests/win.c | 13 ++-----------
 dlls/user32/win.c       | 12 ++++--------
 2 files changed, 6 insertions(+), 19 deletions(-)

diff --git a/dlls/user32/tests/win.c b/dlls/user32/tests/win.c
index 309b699..9f6c224 100644
--- a/dlls/user32/tests/win.c
+++ b/dlls/user32/tests/win.c
@@ -722,7 +722,6 @@ static struct wm_gettext_override_data
     BOOL   enabled; /* when 1 bypasses default procedure */
     char  *buff;    /* expected text buffer pointer */
     WCHAR *buffW;   /* same, for W test */
-    int    len;
 } g_wm_gettext_override;
 
 static LRESULT WINAPI main_window_procA(HWND hwnd, UINT msg, WPARAM wparam, LPARAM lparam)
@@ -810,8 +809,7 @@ static LRESULT WINAPI main_window_procA(HWND hwnd, UINT msg, WPARAM wparam, LPAR
             {
                 char *text = (char*)lparam;
                 ok(g_wm_gettext_override.buff == text, "expected buffer %p, got %p\n", g_wm_gettext_override.buff, text);
-                if (g_wm_gettext_override.len)
-                    ok(*text == 0, "expected empty string buffer %x\n", *text);
+                ok(*text == 0, "expected empty string buffer %x\n", *text);
                 return 0;
             }
             break;
@@ -833,8 +831,7 @@ static LRESULT WINAPI main_window_procW(HWND hwnd, UINT msg, WPARAM wparam, LPAR
             {
                 WCHAR *text = (WCHAR*)lparam;
                 ok(g_wm_gettext_override.buffW == text, "expected buffer %p, got %p\n", g_wm_gettext_override.buffW, text);
-                if (g_wm_gettext_override.len)
-                    ok(*text == 0, "expected empty string buffer %x\n", *text);
+                ok(*text == 0, "expected empty string buffer %x\n", *text);
                 return 0;
             }
             break;
@@ -5819,7 +5816,6 @@ static void test_gettext(void)
     num_gettext_msgs = 0;
     memset( buf, 0xcc, sizeof(buf) );
     g_wm_gettext_override.buff = buf;
-    g_wm_gettext_override.len = sizeof(buf);
     buf_len = GetWindowTextA( hwnd, buf, sizeof(buf) );
     ok( buf_len == 0, "got %d\n", buf_len );
     ok( *buf == 0, "got %x\n", *buf );
@@ -5828,11 +5824,9 @@ static void test_gettext(void)
     num_gettext_msgs = 0;
     strcpy( buf, "blah" );
     g_wm_gettext_override.buff = buf;
-    g_wm_gettext_override.len = 0;
     buf_len = GetWindowTextA( hwnd, buf, 0 );
     ok( buf_len == 0, "got %d\n", buf_len );
     ok( !strcmp(buf, "blah"), "got %s\n", buf );
-todo_wine
     ok( num_gettext_msgs == 0, "got %u WM_GETTEXT messages\n", num_gettext_msgs );
 
     g_wm_gettext_override.enabled = FALSE;
@@ -5846,7 +5840,6 @@ todo_wine
     num_gettext_msgs = 0;
     memset( bufW, 0xcc, sizeof(bufW) );
     g_wm_gettext_override.buffW = bufW;
-    g_wm_gettext_override.len = sizeof(bufW)/sizeof(WCHAR);
     buf_len = GetWindowTextW( hwnd2, bufW, sizeof(bufW)/sizeof(WCHAR) );
     ok( buf_len == 0, "got %d\n", buf_len );
     ok( *bufW == 0, "got %x\n", *bufW );
@@ -5855,11 +5848,9 @@ todo_wine
     num_gettext_msgs = 0;
     memset( bufW, 0xcc, sizeof(bufW) );
     g_wm_gettext_override.buffW = bufW;
-    g_wm_gettext_override.len = 0;
     buf_len = GetWindowTextW( hwnd2, bufW, 0 );
     ok( buf_len == 0, "got %d\n", buf_len );
     ok( *bufW == 0xcccc, "got %x\n", *bufW );
-todo_wine
     ok( num_gettext_msgs == 0, "got %u WM_GETTEXT messages\n", num_gettext_msgs );
 
     g_wm_gettext_override.enabled = FALSE;
diff --git a/dlls/user32/win.c b/dlls/user32/win.c
index 91f1871..e3650f5 100644
--- a/dlls/user32/win.c
+++ b/dlls/user32/win.c
@@ -2676,17 +2676,15 @@ INT WINAPI GetWindowTextA( HWND hwnd, LPSTR lpString, INT nMaxCount )
 {
     WCHAR *buffer;
 
-    if (!lpString) return 0;
+    if (!lpString || nMaxCount <= 0) return 0;
 
     if (WIN_IsCurrentProcess( hwnd ))
     {
-        if (nMaxCount > 0)
-            lpString[0] = 0;
+        lpString[0] = 0;
         return (INT)SendMessageA( hwnd, WM_GETTEXT, nMaxCount, (LPARAM)lpString );
     }
 
     /* when window belongs to other process, don't send a message */
-    if (nMaxCount <= 0) return 0;
     if (!(buffer = HeapAlloc( GetProcessHeap(), 0, nMaxCount * sizeof(WCHAR) ))) return 0;
     get_server_window_text( hwnd, buffer, nMaxCount );
     if (!WideCharToMultiByte( CP_ACP, 0, buffer, -1, lpString, nMaxCount, NULL, NULL ))
@@ -2725,17 +2723,15 @@ INT WINAPI InternalGetWindowText(HWND hwnd,LPWSTR lpString,INT nMaxCount )
  */
 INT WINAPI GetWindowTextW( HWND hwnd, LPWSTR lpString, INT nMaxCount )
 {
-    if (!lpString) return 0;
+    if (!lpString || nMaxCount <= 0) return 0;
 
     if (WIN_IsCurrentProcess( hwnd ))
     {
-        if (nMaxCount > 0)
-            lpString[0] = 0;
+        lpString[0] = 0;
         return (INT)SendMessageW( hwnd, WM_GETTEXT, nMaxCount, (LPARAM)lpString );
     }
 
     /* when window belongs to other process, don't send a message */
-    if (nMaxCount <= 0) return 0;
     get_server_window_text( hwnd, lpString, nMaxCount );
     return strlenW(lpString);
 }
-- 
2.1.4