From: Aric Stewart <aric@codeweavers.com>
Subject: (resend)comctl32: ILC_COLORDDB imagelists can be created with 0 sizes
Message-Id: <55F85FAF.3000601@codeweavers.com>
Date: Tue, 15 Sep 2015 13:13:03 -0500

---
 dlls/comctl32/imagelist.c       |  4 +---
 dlls/comctl32/tests/imagelist.c | 42 +++++++++++++++++++++++++++++++++++++++++
 2 files changed, 43 insertions(+), 3 deletions(-)

diff --git a/dlls/comctl32/imagelist.c b/dlls/comctl32/imagelist.c
index c915472..da71faf 100644
--- a/dlls/comctl32/imagelist.c
+++ b/dlls/comctl32/imagelist.c
@@ -776,7 +776,7 @@ ImageList_Create (INT cx, INT cy, UINT flags,
 
     TRACE("(%d %d 0x%x %d %d)\n", cx, cy, flags, cInitial, cGrow);
 
-    if (cx <= 0 || cy <= 0) return NULL;
+    if (!((flags&ILC_COLORDDB) == ILC_COLORDDB) && (cx <= 0 || cy <= 0)) return NULL;
 
     /* Create the IImageList interface for the image list */
     if (FAILED(ImageListImpl_CreateInstance(NULL, &IID_IImageList, (void **)&himl)))
@@ -1831,8 +1831,6 @@ ImageList_GetIconSize (HIMAGELIST himl, INT *cx, INT *cy)
 {
     if (!is_valid(himl) || !cx || !cy)
 	return FALSE;
-    if ((himl->cx <= 0) || (himl->cy <= 0))
-	return FALSE;
 
     *cx = himl->cx;
     *cy = himl->cy;
diff --git a/dlls/comctl32/tests/imagelist.c b/dlls/comctl32/tests/imagelist.c
index 6f13846..58c8605 100644
--- a/dlls/comctl32/tests/imagelist.c
+++ b/dlls/comctl32/tests/imagelist.c
@@ -1972,7 +1972,11 @@ static void test_iconsize(void)
 static void test_create_destroy(void)
 {
     HIMAGELIST himl;
+    IImageList *imgl;
+    INT cx, cy;
     BOOL rc;
+    HRESULT hr;
+    INT ret;
 
     /* list with zero or negative image dimensions */
     himl = ImageList_Create(0, 0, ILC_COLOR16, 0, 3);
@@ -1992,6 +1996,44 @@ static void test_create_destroy(void)
 
     rc = ImageList_Destroy((HIMAGELIST)0xdeadbeef);
     ok(rc == FALSE, "ImageList_Destroy(0xdeadbeef) should fail and not crash\n");
+
+    /* DDB image lists */
+    if (GetVersion() <= 0x8930005)
+    {
+        win_skip("0 size DDB image lists crash in Windows 2000 and lower\n");
+        return;
+    }
+    himl = ImageList_Create(0, 14, ILC_COLORDDB, 4, 4);
+    ok(himl != NULL, "got %p\n", himl);
+    imgl = (IImageList*)himl;
+    IImageList_GetIconSize(imgl, &cx, &cy);
+    ok (cx == 0, "Wrong cx (%i)\n", cx);
+    ok (cy == 14, "Wrong cy (%i)\n", cy);
+    ImageList_Destroy(himl);
+
+    himl = ImageList_Create(0, 0, ILC_COLORDDB, 4, 4);
+    ok(himl != NULL, "got %p\n", himl);
+    imgl = (IImageList*)himl;
+    IImageList_GetIconSize(imgl, &cx, &cy);
+    ok (cx == 0, "Wrong cx (%i)\n", cx);
+    ok (cy == 0, "Wrong cy (%i)\n", cy);
+    ImageList_Destroy(himl);
+
+    himl = ImageList_Create(0, 0, ILC_COLORDDB, 0, 4);
+    ok(himl != NULL, "got %p\n", himl);
+    imgl = (IImageList*)himl;
+    IImageList_GetIconSize(imgl, &cx, &cy);
+    ok (cx == 0, "Wrong cx (%i)\n", cx);
+    ok (cy == 0, "Wrong cy (%i)\n", cy);
+
+    hr = IImageList_SetImageCount(imgl, 3);
+    ok(hr == S_OK, "got 0x%08x\n", hr);
+    hr = IImageList_GetImageCount(imgl, &ret);
+    ok(hr == S_OK && ret == 3, "invalid image count after increase\n");
+
+    /* Trying to actualy add an image causes a crash on windows */
+
+    ImageList_Destroy(himl);
 }
 
 static void test_IImageList_Clone(void)