From 3371ba9f73367572693589905ed57af87b747b54 Mon Sep 17 00:00:00 2001 From: Nikolay Sivov Date: Thu, 19 Nov 2009 21:05:14 +0300 Subject: [PATCH] comctl32/tab: Fix reading out of array bounds on TCM_SETCURSEL. --- dlls/comctl32/tab.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/dlls/comctl32/tab.c b/dlls/comctl32/tab.c index 15534afb83..f8f9f5cddc 100644 --- a/dlls/comctl32/tab.c +++ b/dlls/comctl32/tab.c @@ -247,16 +247,17 @@ static inline LRESULT TAB_SetCurSel (TAB_INFO *infoPtr, INT iItem) TRACE("(%p %d)\n", infoPtr, iItem); if (iItem < 0) - infoPtr->iSelected=-1; + infoPtr->iSelected = -1; else if (iItem >= infoPtr->uNumItem) return -1; else { - if (infoPtr->iSelected != iItem) { - TAB_GetItem(infoPtr, prevItem)->dwState &= ~TCIS_BUTTONPRESSED; + if (prevItem != iItem) { + if (prevItem != -1) + TAB_GetItem(infoPtr, prevItem)->dwState &= ~TCIS_BUTTONPRESSED; TAB_GetItem(infoPtr, iItem)->dwState |= TCIS_BUTTONPRESSED; - infoPtr->iSelected=iItem; - infoPtr->uFocus=iItem; + infoPtr->iSelected = iItem; + infoPtr->uFocus = iItem; TAB_EnsureSelectionVisible(infoPtr); TAB_InvalidateTabArea(infoPtr); } -- 2.32.0.93.g670b81a890