Toolbar: recover versus bad buttom values

[Carlos Lozano <clozano@xxxxxxxxxx>]

Hello,

It looks like what native toolbar doesn't crashes even
when it receives bad values (or even less values what
it needs). Bad entries are changed by a separator in
native comctl32.  Here is a example:
http://www.catch22.org.uk/tuts/docking2.asp
(thanks to uriel for help testing it)

Regards,
Carlos. 

-- 
 ___         _          \  |  /  Consulting
| . |._ _  _| | ___  ___  ___    http://www.andago.com
|   || ' |/ . |<_> |/ . |/ . \__ GNU/Linux
|_|_||_|_|\___|<___|\_. |\___/     _ \  __|\ \  /
 Carlos A. Lozano   <___'/ | \ -_) __/\__ \ >  <  -_)
 [ carlos.lozano@xxxxxxxxxx ]\___|_|  ____/ _/\_\___|
 [ calb@xxxxxxxxx           ]  http://www.epsxe.com

Index: dlls/comctl32/toolbar.c
===================================================================
RCS file: /home/wine/wine/dlls/comctl32/toolbar.c,v
retrieving revision 1.143
diff -u -r1.143 toolbar.c
--- dlls/comctl32/toolbar.c	5 Nov 2003 00:35:28 -0000	1.143
+++ dlls/comctl32/toolbar.c	9 Nov 2003 21:53:06 -0000
@@ -2418,13 +2418,29 @@
     /* insert new button data */
     for (nCount = 0; nCount < nAddButtons; nCount++) {
 	TBUTTON_INFO *btnPtr = &infoPtr->buttons[nOldButtons+nCount];
-	btnPtr->iBitmap   = lpTbb[nCount].iBitmap;
-	btnPtr->idCommand = lpTbb[nCount].idCommand;
-	btnPtr->fsState   = lpTbb[nCount].fsState;
-	btnPtr->fsStyle   = lpTbb[nCount].fsStyle;
-	btnPtr->dwData    = lpTbb[nCount].dwData;
-	btnPtr->iString   = lpTbb[nCount].iString;
-	btnPtr->bHot      = FALSE;
+
+        if (IsBadReadPtr((void *)lpTbb[nCount].iString,1) &&
+            (HIWORD(lpTbb[nCount].iString) != 0) && (lpTbb[nCount].iString != -1)) 
+        { 
+            FIXME(" Bad init button values\n");
+            btnPtr->iString   = 0;
+            btnPtr->iBitmap   = 0;
+            btnPtr->idCommand = 0;
+            btnPtr->fsState   = 0;
+            btnPtr->fsStyle   = TBSTYLE_SEP;
+            btnPtr->dwData    = 0;
+            btnPtr->bHot      = FALSE;
+        }
+        else
+        {
+            btnPtr->iString   = lpTbb[nCount].iString;
+            btnPtr->iBitmap   = lpTbb[nCount].iBitmap;
+            btnPtr->idCommand = lpTbb[nCount].idCommand;
+            btnPtr->fsState   = lpTbb[nCount].fsState;
+            btnPtr->fsStyle   = lpTbb[nCount].fsStyle;
+            btnPtr->dwData    = lpTbb[nCount].dwData;
+            btnPtr->bHot      = FALSE;
+        }
 
 	if ((infoPtr->hwndToolTip) && !(btnPtr->fsStyle & TBSTYLE_SEP)) {
 	    TTTOOLINFOA ti;