X-Git-Url: https://git.saurik.com/wxWidgets.git/blobdiff_plain/b4da152ea3ec3968fb2f304b6ed73e0279c19506..cfcc39321282c5877cbb45248bb8004ced24516b:/src/msw/listctrl.cpp

diff --git a/src/msw/listctrl.cpp b/src/msw/listctrl.cpp
index 15356ad7d9..943a87ae8d 100644
--- a/src/msw/listctrl.cpp
+++ b/src/msw/listctrl.cpp
@@ -1752,7 +1752,7 @@ bool wxListCtrl::MSWOnNotify(int idCtrl, WXLPARAM lParam, WXLPARAM *result)
                     // there's a GPF in Windows.
                     // By returning TRUE here, we avoid further processing
                     // of this strange message.
-                    if (info->iItem > GetColumnCount())
+                    if ( info->iItem >= GetColumnCount() )
                         return TRUE;
                 }
                 // fall through
@@ -1781,6 +1781,30 @@ bool wxListCtrl::MSWOnNotify(int idCtrl, WXLPARAM lParam, WXLPARAM *result)
             case LVN_ITEMCHANGING:
                 if ( iItem != -1 )
                 {
+                    if ( iItem >= GetItemCount() )
+                    {
+                        // there is apparently a bug in comctl32.dll version
+                        // 5.50.4704.1100 (note that the MS DLL database
+                        // doesn't say what this version is, it's not the one
+                        // shipped with W2K although the bug was reported under
+                        // that system) and it sends us LVN_ITEMCHANGING
+                        // notifications with the item out of range -- and as
+                        // we access the items client data, we crash below
+                        //
+                        // see
+                        //
+                        //  http://lists.wxwindows.org/cgi-bin/ezmlm-cgi?8:mss:29852:knlihdmadhaljafjajei
+                        //
+                        // and the thread continuation for more details
+                        // (although note that the bug may be present in other
+                        // versions of comctl32.dll as well as it has been
+                        // reported quite a few times)
+                        //
+                        // to fix this, simply ignore these "bad" events (as
+                        // above with HDN_GETDISPINFOW)
+                        return TRUE;
+                    }
+
                     wxListItemInternalData *internaldata =
                         (wxListItemInternalData *) nmLV->lParam;