comctl32/monthcal: After notification safely free buffer allocated on heap.

dlls/comctl32/monthcal.c

@@ -1884,24 +1884,25 @@ MONTHCAL_HitTest(const MONTHCAL_INFO *infoPtr, MCHITTESTINFO *lpht)
 /* MCN_GETDAYSTATE notification helper */
 static void MONTHCAL_NotifyDayState(MONTHCAL_INFO *infoPtr)
 {
-  if(infoPtr->dwStyle & MCS_DAYSTATE) {
-    NMDAYSTATE nmds;
+  MONTHDAYSTATE *state;
+  NMDAYSTATE nmds;
 
-    nmds.nmhdr.hwndFrom = infoPtr->hwndSelf;
-    nmds.nmhdr.idFrom   = GetWindowLongPtrW(infoPtr->hwndSelf, GWLP_ID);
-    nmds.nmhdr.code     = MCN_GETDAYSTATE;
-    nmds.cDayState	= MONTHCAL_GetMonthRange(infoPtr, GMR_DAYSTATE, 0);
-    nmds.prgDayState	= Alloc(nmds.cDayState * sizeof(MONTHDAYSTATE));
+  if (!(infoPtr->dwStyle & MCS_DAYSTATE)) return;
 
-    MONTHCAL_GetMinDate(infoPtr, &nmds.stStart);
-    nmds.stStart.wDay = 1;
+  nmds.nmhdr.hwndFrom = infoPtr->hwndSelf;
+  nmds.nmhdr.idFrom   = GetWindowLongPtrW(infoPtr->hwndSelf, GWLP_ID);
+  nmds.nmhdr.code     = MCN_GETDAYSTATE;
+  nmds.cDayState      = MONTHCAL_GetMonthRange(infoPtr, GMR_DAYSTATE, 0);
+  nmds.prgDayState    = state = Alloc(nmds.cDayState * sizeof(MONTHDAYSTATE));
 
-    SendMessageW(infoPtr->hwndNotify, WM_NOTIFY, nmds.nmhdr.idFrom, (LPARAM)&nmds);
-    memcpy(infoPtr->monthdayState, nmds.prgDayState,
-        MONTHCAL_GetMonthRange(infoPtr, GMR_DAYSTATE, 0)*sizeof(MONTHDAYSTATE));
+  MONTHCAL_GetMinDate(infoPtr, &nmds.stStart);
+  nmds.stStart.wDay = 1;
 
-    Free(nmds.prgDayState);
-  }
+  SendMessageW(infoPtr->hwndNotify, WM_NOTIFY, nmds.nmhdr.idFrom, (LPARAM)&nmds);
+  memcpy(infoPtr->monthdayState, nmds.prgDayState,
+      MONTHCAL_GetMonthRange(infoPtr, GMR_DAYSTATE, 0)*sizeof(MONTHDAYSTATE));
+
+  Free(state);
 }
 
 /* no valid range check performed */

dlls/comctl32/tests/monthcal.c

@@ -466,6 +466,29 @@ static LRESULT WINAPI parent_wnd_proc(HWND hwnd, UINT message, WPARAM wParam, LP
         add_message(sequences, PARENT_SEQ_INDEX, &msg);
     }
 
+    if (message == WM_NOTIFY)
+    {
+        NMHDR *hdr = (NMHDR*)lParam;
+        switch (hdr->code)
+        {
+          case MCN_GETDAYSTATE:
+          {
+            NMDAYSTATE *nmstate = (NMDAYSTATE*)lParam;
+            MONTHDAYSTATE months[14] = { 0 };
+
+            ok(nmstate->cDayState > 0, "got %d\n", nmstate->cDayState);
+            ok(nmstate->cDayState <= 14, "got %d\n", nmstate->cDayState);
+            ok(nmstate->prgDayState != NULL, "got %p\n", nmstate->prgDayState);
+
+            nmstate->prgDayState = months;
+
+            return TRUE;
+          }
+          default:
+            break;
+        }
+    }
+
     defwndproc_counter++;
     ret = DefWindowProcA(hwnd, message, wParam, lParam);
     defwndproc_counter--;