Commit 079912c6 authored by Rein Klazes's avatar Rein Klazes Committed by Alexandre Julliard

user32: Prevent a crash in GetMenuStringA caused by calling strlenW on

a NULL pointer, with a test.
parent 194eeaab
......@@ -3295,6 +3295,7 @@ INT WINAPI GetMenuStringA(
SetLastError( ERROR_MENU_ITEM_NOT_FOUND);
return 0;
}
if (!item->text) return 0;
if (!str || !nMaxSiz) return strlenW(item->text);
if (!WideCharToMultiByte( CP_ACP, 0, item->text, -1, str, nMaxSiz, NULL, NULL ))
str[nMaxSiz-1] = 0;
......
......@@ -348,6 +348,19 @@ static void test_menu_add_string( void )
ok (GetMenuString( hmenu, 0, strback, 99, MF_BYPOSITION), "GetMenuString on ownerdraw entry failed\n");
ok (!strcmp( strback, "string2" ), "Menu text from Ansi version incorrect\n");
/* crashes with wine 0.9.5 */
memset(&info, 0x00, sizeof(info));
info.cbSize= sizeof(MENUITEMINFO);
info.fMask= MIIM_FTYPE | MIIM_STRING; /* Set OwnerDraw + typeData */
info.fType= MFT_OWNERDRAW;
rc = InsertMenuItem( hmenu, 0, TRUE, &info );
ok (rc, "InsertMenuItem failed\n");
ok (!GetMenuString( hmenu, 0, NULL, 0, MF_BYPOSITION),
"GetMenuString on ownerdraw entry succeeded.\n");
ok (!GetMenuStringW( hmenu, 0, NULL, 0, MF_BYPOSITION),
"GetMenuStringW on ownerdraw entry succeeded.\n");
DestroyMenu( hmenu );
}
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment