From f17d904d2d93f11bd4621d4bb06d9a6dbc311f67 Mon Sep 17 00:00:00 2001 From: Ahmed Arif Date: Thu, 25 Jun 2026 18:22:15 +0200 Subject: [PATCH] [WIN32SS:NTUSER] Return NO_SELECTED_ITEM from NtUserMenuItemFromPoint() when no item is hit (#9121) Fix the bug, where `NtUserMenuItemFromPoint()` returned `cItems` instead of `NO_SELECTED_ITEM` when no item is under the point (`mi` is never NULL on a miss), so `MenuItemFromPoint()` callers could have indexed one past the menu array. --- win32ss/user/ntuser/menu.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/win32ss/user/ntuser/menu.c b/win32ss/user/ntuser/menu.c index 747ed0ca2d3..def568e611e 100644 --- a/win32ss/user/ntuser/menu.c +++ b/win32ss/user/ntuser/menu.c @@ -6348,7 +6348,7 @@ NtUserMenuItemFromPoint( } } - Ret = (mi ? i : NO_SELECTED_ITEM); + Ret = (i < Menu->cItems ? i : NO_SELECTED_ITEM); Exit: UserLeave();