Added some sanity checks on window dimensions.

dlls/user/combo.c

@@ -560,8 +560,11 @@ static LRESULT COMBO_Create( HWND hwnd, LPHEADCOMBO lphc, HWND hwndParent, LONG
 	if( CB_GETTYPE(lphc) == CBS_DROPDOWN )
 	  lphc->droppedRect.left += COMBO_EDITBUTTONSPACE();
 
-	ClientToScreen(hwnd, (LPPOINT)&lphc->droppedRect);
-	ClientToScreen(hwnd, (LPPOINT)&lphc->droppedRect.right);
+        if (lphc->droppedRect.bottom < lphc->droppedRect.top)
+            lphc->droppedRect.bottom = lphc->droppedRect.top;
+        if (lphc->droppedRect.right < lphc->droppedRect.left)
+            lphc->droppedRect.right = lphc->droppedRect.left;
+        MapWindowPoints( hwnd, 0, (LPPOINT)&lphc->droppedRect, 2 );
       }
 
       /* create listbox popup */

dlls/x11drv/window.c

@@ -985,6 +985,16 @@ BOOL X11DRV_CreateWindow( HWND hwnd, CREATESTRUCTA *cs, BOOL unicode )
         ERR( "invalid window height %d\n", cs->cy );
         cs->cy = 65535;
     }
+    if (cs->cx < 0)
+    {
+        ERR( "invalid window width %d\n", cs->cx );
+        cs->cx = 0;
+    }
+    if (cs->cy < 0)
+    {
+        ERR( "invalid window height %d\n", cs->cy );
+        cs->cy = 0;
+    }
 
     if (!(data = HeapAlloc(GetProcessHeap(), 0, sizeof(*data)))) return FALSE;
     data->whole_window  = 0;

dlls/x11drv/winpos.c

@@ -426,7 +426,13 @@ static UINT SWP_DoNCCalcSize( WINDOWPOS* pWinpos, const RECT* pNewWindowRect, RE
         TRACE( "(%ld,%ld)-(%ld,%ld)\n", params.rgrc[0].left, params.rgrc[0].top,
                params.rgrc[0].right, params.rgrc[0].bottom );
 
-        /* If the application send back garbage, ignore it */
+        /* If the application sends back garbage, ignore it */
+
+        if (params.rgrc[0].left < pNewWindowRect->left) params.rgrc[0].left = pNewWindowRect->left;
+        if (params.rgrc[0].top < pNewWindowRect->top) params.rgrc[0].top = pNewWindowRect->top;
+        if (params.rgrc[0].right > pNewWindowRect->right) params.rgrc[0].right = pNewWindowRect->right;
+        if (params.rgrc[0].bottom > pNewWindowRect->bottom) params.rgrc[0].bottom = pNewWindowRect->bottom;
+
         if (params.rgrc[0].left <= params.rgrc[0].right &&
             params.rgrc[0].top <= params.rgrc[0].bottom)
             *pNewClientRect = params.rgrc[0];