From c8f8e5da119c01d84ac787c3eec1fbbba292c5b0 Mon Sep 17 00:00:00 2001
From: Nikolay Sivov <bunglehead@gmail.com>
Date: Sat, 12 Sep 2009 03:32:02 +0400
Subject: [PATCH] comctl32/dpa: Fix parameter validation in DPA_LoadStream().

---
 dlls/comctl32/dpa.c       | 21 +++++++++------------
 dlls/comctl32/tests/dpa.c |  6 +++---
 2 files changed, 12 insertions(+), 15 deletions(-)

diff --git a/dlls/comctl32/dpa.c b/dlls/comctl32/dpa.c
index f9c8afc8bd..ca282824a6 100644
--- a/dlls/comctl32/dpa.c
+++ b/dlls/comctl32/dpa.c
@@ -84,7 +84,7 @@ HRESULT WINAPI DPA_LoadStream (HDPA *phDpa, PFNDPASTREAM loadProc,
 {
     HRESULT errCode;
     LARGE_INTEGER position;
-    ULARGE_INTEGER newPosition;
+    ULARGE_INTEGER initial_pos;
     STREAMDATA  streamData;
     DPASTREAMINFO streamInfo;
     ULONG ulRead;
@@ -101,15 +101,11 @@ HRESULT WINAPI DPA_LoadStream (HDPA *phDpa, PFNDPASTREAM loadProc,
 
     position.QuadPart = 0;
 
-    /*
-     * Zero out our streamData
-     */
-    memset(&streamData,0,sizeof(STREAMDATA));
-
-    errCode = IStream_Seek (pStream, position, STREAM_SEEK_CUR, &newPosition);
+    errCode = IStream_Seek (pStream, position, STREAM_SEEK_CUR, &initial_pos);
     if (errCode != S_OK)
         return errCode;
 
+    memset(&streamData, 0, sizeof(STREAMDATA));
     errCode = IStream_Read (pStream, &streamData, sizeof(STREAMDATA), &ulRead);
     if (errCode != S_OK)
         return errCode;
@@ -117,11 +113,12 @@ HRESULT WINAPI DPA_LoadStream (HDPA *phDpa, PFNDPASTREAM loadProc,
     FIXME ("dwSize=%u dwData2=%u dwItems=%u\n",
            streamData.dwSize, streamData.dwData2, streamData.dwItems);
 
-    if ( ulRead < sizeof(STREAMDATA) ||
-    (DWORD)pData < sizeof(STREAMDATA) ||
-        streamData.dwSize < sizeof(STREAMDATA) ||
-        streamData.dwData2 < 1) {
-        errCode = E_FAIL;
+    if (ulRead < sizeof(STREAMDATA) ||
+        streamData.dwSize < sizeof(STREAMDATA) || streamData.dwData2 != 1) {
+        /* back to initial position */
+        position.QuadPart = initial_pos.QuadPart;
+        IStream_Seek (pStream, position, STREAM_SEEK_SET, NULL);
+        return E_FAIL;
     }
 
     if (streamData.dwItems > (UINT_MAX / 2 / sizeof(VOID*))) /* 536870911 */
diff --git a/dlls/comctl32/tests/dpa.c b/dlls/comctl32/tests/dpa.c
index 5d7124aadd..54e8d0ef48 100644
--- a/dlls/comctl32/tests/dpa.c
+++ b/dlls/comctl32/tests/dpa.c
@@ -586,7 +586,7 @@ static void test_DPA_LoadStream(void)
     uli.QuadPart = 1;
     hRes = IStream_Seek(pStm, li, STREAM_SEEK_CUR, &uli);
     expect(S_OK, hRes);
-    todo_wine ok(uli.QuadPart == 0, "Expected to position reset\n");
+    ok(uli.QuadPart == 0, "Expected to position reset\n");
 
     /* write valid header for empty DPA */
     header.dwSize = sizeof(header);
@@ -612,7 +612,7 @@ static void test_DPA_LoadStream(void)
     expect(S_OK, hRes);
 
     hRes = pDPA_LoadStream(&dpa, CB_Load, pStm, NULL);
-    todo_wine expect(S_OK, hRes);
+    expect(S_OK, hRes);
 
     /* try with altered dwData2 field */
     header.dwSize = sizeof(header);
@@ -632,7 +632,7 @@ static void test_DPA_LoadStream(void)
     expect(S_OK, hRes);
 
     hRes = pDPA_LoadStream(&dpa, CB_Load, pStm, (void*)0xdeadbeef);
-    todo_wine expect(E_FAIL, hRes);
+    expect(E_FAIL, hRes);
 
     ret = IStream_Release(pStm);
     ok(!ret, "ret=%d\n", ret);
-- 
2.32.0.93.g670b81a890