From d2cc7ec4a07caa600faecff637210b6aa30f3dce Mon Sep 17 00:00:00 2001
From: Thomas Bluemel <thomas@reactsoft.com>
Date: Sun, 12 Dec 2004 20:40:06 +0000
Subject: [PATCH] MessageBoxIndirectA() should check whether the MB_USERICON
 bit was set, otherwise in case the lpszIcon field of the MSGBOXPARAMS
 structure, the application passed to it, was never initialized and is not
 being interpreted as an atom, it takes this random pointer and tries to
 convert the string inside it to unicode - which might cause an exception. it
 solves a problem with winzip hardon discovered. The bug also exists in wine
 but doesn't appear to arise.

svn path=/trunk/; revision=12056
---
 reactos/lib/user32/windows/messagebox.c | 25 +++++++++++++++----------
 1 file changed, 15 insertions(+), 10 deletions(-)

diff --git a/reactos/lib/user32/windows/messagebox.c b/reactos/lib/user32/windows/messagebox.c
index 8c1b260ac05..4ced7e4f1d1 100644
--- a/reactos/lib/user32/windows/messagebox.c
+++ b/reactos/lib/user32/windows/messagebox.c
@@ -16,7 +16,7 @@
  *  along with this program; if not, write to the Free Software
  *  Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  */
-/* $Id: messagebox.c,v 1.29 2004/11/19 19:34:11 weiden Exp $
+/* $Id: messagebox.c,v 1.30 2004/12/12 20:40:06 weiden Exp $
  *
  * PROJECT:         ReactOS user32.dll
  * FILE:            lib/user32/windows/messagebox.c
@@ -739,17 +739,22 @@ MessageBoxIndirectA(
     else
         captionW.Buffer = (LPWSTR)lpMsgBoxParams->lpszCaption;
 
-    if (HIWORD((UINT)lpMsgBoxParams->lpszIcon))
+    if(lpMsgBoxParams->dwStyle & MB_USERICON)
     {
-        RtlCreateUnicodeStringFromAsciiz(&iconW, (PCSZ)lpMsgBoxParams->lpszIcon);
-        /*
-         * UNICODE_STRING objects are always allocated with an extra byte so you
-         * can null-term if you want
-         */
-        iconW.Buffer[iconW.Length / sizeof(WCHAR)] = L'\0';
+        if (HIWORD((UINT)lpMsgBoxParams->lpszIcon))
+        {
+            RtlCreateUnicodeStringFromAsciiz(&iconW, (PCSZ)lpMsgBoxParams->lpszIcon);
+            /*
+             * UNICODE_STRING objects are always allocated with an extra byte so you
+             * can null-term if you want
+             */
+            iconW.Buffer[iconW.Length / sizeof(WCHAR)] = L'\0';
+        }
+        else
+            iconW.Buffer = (LPWSTR)lpMsgBoxParams->lpszIcon;
     }
     else
-        iconW.Buffer = (LPWSTR)lpMsgBoxParams->lpszIcon;
+        iconW.Buffer = NULL;
 
     msgboxW.cbSize = sizeof(msgboxW);
     msgboxW.hwndOwner = lpMsgBoxParams->hwndOwner;
@@ -770,7 +775,7 @@ MessageBoxIndirectA(
     if (HIWORD((UINT)lpMsgBoxParams->lpszCaption))
         RtlFreeUnicodeString(&captionW);
 
-    if (HIWORD((UINT)lpMsgBoxParams->lpszIcon))
+    if ((lpMsgBoxParams->dwStyle & MB_USERICON) && HIWORD((UINT)iconW.Buffer))
         RtlFreeUnicodeString(&iconW);
 
     return ret;