comctl32/imagelist: Fix crash with large number of images.

Fix a crash that occurred when reading a imagelist with a large number of images. In the particular case we read a cMaxImage value of 1032, but allocated only 40 or so images. This lead to memory corruption in ImageList_Read. This change allows to run TntConnect. Signed-off-by: Eberhard Beilharz <eb1@sil.org> Signed-off-by: Alexandre Julliard <julliard@winehq.org>

comctl32/imagelist: Fix crash with large number of images.
f760079a · Eberhard Beilharz · Alexandre Julliard · 64addb51 · f760079a
Commit f760079a authored Dec 11, 2018 by Eberhard Beilharz Committed by Alexandre Julliard Dec 12, 2018
Hide whitespace changes
Inline Side-by-side

Showing with 1 addition and 1 deletion

imagelist.c dlls/comctl32/imagelist.c +1 -1

No files found.
--- a/dlls/comctl32/imagelist.c
+++ b/dlls/comctl32/imagelist.c
@@ -2273,7 +2273,7 @@ HIMAGELIST WINAPI ImageList_Read(IStream *pstm)
    TRACE("cx %u, cy %u, flags 0x%04x, cCurImage %u, cMaxImage %u\n",
          ilHead.cx, ilHead.cy, ilHead.flags, ilHead.cCurImage, ilHead.cMaxImage);

-    himl = ImageList_Create(ilHead.cx, ilHead.cy, ilHead.flags, ilHead.cCurImage, ilHead.cMaxImage);
+    himl = ImageList_Create(ilHead.cx, ilHead.cy, ilHead.flags, ilHead.cMaxImage, ilHead.cGrow);
    if (!himl)
 	return NULL;