On 8/6/2010 22:22, André Hentschel wrote:
got that case with an MFC application which had a 3state radiobutton with
buttonstyle 15(decimal)
with this fix everything is fine as the painting of the button is handled
elsewhere, without that fix it crashes as it reads bad data behind the array.
---
dlls/user32/button.c | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/dlls/user32/button.c b/dlls/user32/button.c
index 54d54dc..4f629f0 100644
--- a/dlls/user32/button.c
+++ b/dlls/user32/button.c
@@ -197,7 +197,7 @@ static inline UINT get_button_type( LONG window_style )
/* paint a button of any type */
static inline void paint_button( HWND hwnd, LONG style, UINT action )
{
- if (btnPaintFunc[style]&& IsWindowVisible(hwnd))
+ if (style<= MAX_BTN_TYPE&& btnPaintFunc[style]&& IsWindowVisible(hwnd))
{
HDC hdc = GetDC( hwnd );
btnPaintFunc[style]( hwnd, hdc, action );
This needs a test to see what happens visually for style 0xf, maybe we
need just to duplicate an entry in paint function table; also while
you're at it:
static inline UINT get_button_type( LONG window_style )
{
return (window_style & 0x0f);
}
here BS_TYPEMASK should be used instead of 0xf.
