Listbox delete string handling should validate the range of the

dlls/user/listbox.c

@@ -1662,8 +1662,7 @@ static LRESULT LISTBOX_RemoveItem( LB_DESCR *descr, INT index )
     LB_ITEMDATA *item;
     INT max_items;
 
-    if ((index == -1) && (descr->nb_items > 0)) index = descr->nb_items - 1;
-    else if ((index < 0) || (index >= descr->nb_items)) return LB_ERR;
+    if ((index < 0) || (index >= descr->nb_items)) return LB_ERR;
 
     /* We need to invalidate the original rect instead of the updated one. */
     LISTBOX_InvalidateItems( descr, index );
@@ -1760,7 +1759,7 @@ static LRESULT LISTBOX_SetCount( LB_DESCR *descr, INT count )
     else if (count < descr->nb_items)
     {
         while (count < descr->nb_items)
-            if ((ret = LISTBOX_RemoveItem( descr, -1 )) < 0)
+            if ((ret = LISTBOX_RemoveItem( descr, (descr->nb_items - 1) )) < 0)
                 return ret;
     }
     return LB_OKAY;

dlls/user/tests/listbox.c

@@ -139,6 +139,7 @@ check (const struct listbox_test test)
   HWND hLB=create_listbox (test.prop.add_style, 0);
   RECT second_item;
   int i;
+  int res;
 
   listbox_query (hLB, &answer);
   listbox_ok (test, init, answer);
@@ -179,6 +180,16 @@ check (const struct listbox_test test)
 	HeapFree (GetProcessHeap(), 0, txt);
   }
   
+  /* Confirm the count of items, and that an invalid delete does not remove anything */
+  res = SendMessage (hLB, LB_GETCOUNT, 0, 0);
+  ok((res==4), "Expected 4 items, got %d\n", res);
+  res = SendMessage (hLB, LB_DELETESTRING, -1, 0);
+  ok((res==LB_ERR), "Expected LB_ERR items, got %d\n", res);
+  res = SendMessage (hLB, LB_DELETESTRING, 4, 0);
+  ok((res==LB_ERR), "Expected LB_ERR items, got %d\n", res);
+  res = SendMessage (hLB, LB_GETCOUNT, 0, 0);
+  ok((res==4), "Expected 4 items, got %d\n", res);
+
   WAIT;
   DestroyWindow (hLB);
 }