comctl32/monthcal: After notification safely free buffer allocated on heap.

dlls/comctl32/monthcal.c

@@ -1884,14 +1884,16 @@ MONTHCAL_HitTest(const MONTHCAL_INFO *infoPtr, MCHITTESTINFO *lpht)
 /* MCN_GETDAYSTATE notification helper */
 static void MONTHCAL_NotifyDayState(MONTHCAL_INFO *infoPtr)
 {
-  if(infoPtr->dwStyle & MCS_DAYSTATE) {
+  MONTHDAYSTATE *state;
   NMDAYSTATE nmds;
 
+  if (!(infoPtr->dwStyle & MCS_DAYSTATE)) return;
+
   nmds.nmhdr.hwndFrom = infoPtr->hwndSelf;
   nmds.nmhdr.idFrom   = GetWindowLongPtrW(infoPtr->hwndSelf, GWLP_ID);
   nmds.nmhdr.code     = MCN_GETDAYSTATE;
   nmds.cDayState      = MONTHCAL_GetMonthRange(infoPtr, GMR_DAYSTATE, 0);
-    nmds.prgDayState	= Alloc(nmds.cDayState * sizeof(MONTHDAYSTATE));
+  nmds.prgDayState    = state = Alloc(nmds.cDayState * sizeof(MONTHDAYSTATE));
 
   MONTHCAL_GetMinDate(infoPtr, &nmds.stStart);
   nmds.stStart.wDay = 1;
@@ -1900,8 +1902,7 @@ static void MONTHCAL_NotifyDayState(MONTHCAL_INFO *infoPtr)
   memcpy(infoPtr->monthdayState, nmds.prgDayState,
       MONTHCAL_GetMonthRange(infoPtr, GMR_DAYSTATE, 0)*sizeof(MONTHDAYSTATE));
 
-    Free(nmds.prgDayState);
-  }
+  Free(state);
 }
 
 /* no valid range check performed */

dlls/comctl32/tests/monthcal.c

@@ -466,6 +466,29 @@ static LRESULT WINAPI parent_wnd_proc(HWND hwnd, UINT message, WPARAM wParam, LP
         add_message(sequences, PARENT_SEQ_INDEX, &msg);
     }
 
+    if (message == WM_NOTIFY)
+    {
+        NMHDR *hdr = (NMHDR*)lParam;
+        switch (hdr->code)
+        {
+          case MCN_GETDAYSTATE:
+          {
+            NMDAYSTATE *nmstate = (NMDAYSTATE*)lParam;
+            MONTHDAYSTATE months[14] = { 0 };
+
+            ok(nmstate->cDayState > 0, "got %d\n", nmstate->cDayState);
+            ok(nmstate->cDayState <= 14, "got %d\n", nmstate->cDayState);
+            ok(nmstate->prgDayState != NULL, "got %p\n", nmstate->prgDayState);
+
+            nmstate->prgDayState = months;
+
+            return TRUE;
+          }
+          default:
+            break;
+        }
+    }
+
     defwndproc_counter++;
     ret = DefWindowProcA(hwnd, message, wParam, lParam);
     defwndproc_counter--;