rsegal
5th September 2003 21:30 UTC

Problem with InstallOptions "WMCommandProc"
  Possibly a problem with WMCommandProc function in the InstallOptions DLL. This is the current function. A possible crash exists as nIdx is not checked for a value < 0 before it is used which would result in an invalid array index.

LRESULT WMCommandProc(HWND hWnd, UINT id, HWND hwndCtl, UINT codeNotify) {

    switch (codeNotify) {

        caseBN_CLICKED:

      {

       int nIdx = FindControlIdx(id);

        

        if (pFields***91;nIdx***93;.nType == FIELD_BROWSEBUTTON) {

         int nParentIdx = pFields***91;nIdx***93;.nParentIdx;

          switch(pFields***91;nParentIdx***93;.nType) {

          caseFIELD_FILEREQUEST:

           BrowseForFile(nParentIdx);

            break;

          caseFIELD_DIRREQUEST:

           BrowseForFolder(nParentIdx);

            break;

          }

          break;

        } else if (pFields***91;nIdx***93;.nType == FIELD_LINK) {

         ShellExecute(hMainWindow, NULL, pFields***91;nIdx***93;.pszState, NULL, NULL, SW_SHOWDEFAULT);

        }

      }

            break;

    }

    return0;

} 

The modified version with the array bounds check,

LRESULT WMCommandProc(HWND hWnd, UINT id, HWND hwndCtl, UINT codeNotify) {

    switch (codeNotify) {

        caseBN_CLICKED:

      {

       int nIdx = FindControlIdx(id);

        

                // I only added the next two lines for some error  

                // checking

       if (nIdx < 0)

                   break;


        if (pFields***91;nIdx***93;.nType == FIELD_BROWSEBUTTON) {

         int nParentIdx = pFields***91;nIdx***93;.nParentIdx;

          switch(pFields***91;nParentIdx***93;.nType) {

          caseFIELD_FILEREQUEST:

           BrowseForFile(nParentIdx);

            break;

          caseFIELD_DIRREQUEST:

           BrowseForFolder(nParentIdx);

            break;

          }

          break;

        } else if (pFields***91;nIdx***93;.nType == FIELD_LINK) {

         ShellExecute(hMainWindow, NULL, pFields***91;nIdx***93;.pszState, NULL, NULL, SW_SHOWDEFAULT);

        }

      }

            break;

    }

    return0;

} 

End result, everything is super. I do wonder why I was getting an array index less than 0 but I was.

kichik
7th September 2003 15:28 UTC

Thanks, I have uploaded a version that checks the return value of FindControlIdx. I'm still waiting for Ramon to look over it to see where the problem really comes from.

ramon18
8th September 2003 10:45 UTC

Hi rsegal,

Can you upload the ini file that cause this problems? thanks.
The reason why I don't check the return value from FindControlIdx is to save some code bytes, so the problem should be elsewhere, just because FindControlIdx should always find the right control when receiving messages through WMCommandProc, but, hummm, I must admit parent WM_COMMAND messages are forward now to child windows if not handled by main window (ie: Back, Next, Cancel buttons), maybe the problem arise here!

Perhaps, your fix is really needed there. But I want to inspect with the ini that cause the problems

Ramon,
cyas