From 6bac4f2c1556ca81dfdfdde8cf4e9ff33d165aa2 Mon Sep 17 00:00:00 2001
From: Stephane Lussier <stephane@macadamian.com>
Date: Fri, 29 Sep 2000 00:56:05 +0000
Subject: [PATCH] Before calling the timer window proc, make sure it is valid.

---
 include/message.h |  2 ++
 windows/message.c | 20 ++++++++++++++++++++
 windows/timer.c   | 24 ++++++++++++++++++++++++
 3 files changed, 46 insertions(+)

diff --git a/include/message.h b/include/message.h
index 29decbc468b..463921bdcf3 100644
--- a/include/message.h
+++ b/include/message.h
@@ -9,6 +9,7 @@
 
 #include "windef.h"
 #include "wine/windef16.h"
+#include "winproc.h"
 
 struct tagMSG;
 
@@ -22,6 +23,7 @@ extern void TIMER_RemoveWindowTimers( HWND hwnd );
 extern void TIMER_RemoveQueueTimers( HQUEUE16 hqueue );
 extern BOOL TIMER_GetTimerMsg( struct tagMSG *msg, HWND hwnd,
                                  HQUEUE16 hQueue, BOOL remove );
+extern BOOL TIMER_IsTimerValid( HWND hwnd, UINT id, HWINDOWPROC hProc );
 
 /* event.c */
 extern void EVENT_Synchronize( void );
diff --git a/windows/message.c b/windows/message.c
index 2e63551c035..880c860806e 100644
--- a/windows/message.c
+++ b/windows/message.c
@@ -2283,6 +2283,12 @@ LONG WINAPI DispatchMessage16( const MSG16* msg )
     {
 	if (msg->lParam)
         {
+            /* before calling window proc, verify it the timer is still valid,
+               there's a slim chance the application kill the timer between
+               getMessage and DisaptachMessage API calls */
+            if (!TIMER_IsTimerValid(msg->hwnd, (UINT) msg->wParam, (HWINDOWPROC) msg->lParam))
+                return 0; /* invalid winproc */
+
 	    return CallWindowProc16( (WNDPROC16)msg->lParam, msg->hwnd,
                                    msg->message, msg->wParam, GetTickCount() );
         }
@@ -2359,6 +2365,13 @@ LONG WINAPI DispatchMessageA( const MSG* msg )
 	if (msg->lParam)
         {
 /*            HOOK_CallHooks32A( WH_CALLWNDPROC, HC_ACTION, 0, FIXME ); */
+
+            /* before calling window proc, verify it the timer is still valid,
+               there's a slim chance the application kill the timer between
+               getMessage and DisaptachMessage API calls */
+            if (!TIMER_IsTimerValid(msg->hwnd, (UINT) msg->wParam, (HWINDOWPROC) msg->lParam))
+                return 0; /* invalid winproc */
+
 	    return CallWindowProcA( (WNDPROC)msg->lParam, msg->hwnd,
                                    msg->message, msg->wParam, GetTickCount() );
         }
@@ -2434,6 +2447,13 @@ LONG WINAPI DispatchMessageW( const MSG* msg )
 	if (msg->lParam)
         {
 /*            HOOK_CallHooks32W( WH_CALLWNDPROC, HC_ACTION, 0, FIXME ); */
+
+            /* before calling window proc, verify it the timer is still valid,
+               there's a slim chance the application kill the timer between
+               getMessage and DisaptachMessage API calls */
+            if (!TIMER_IsTimerValid(msg->hwnd, (UINT) msg->wParam, (HWINDOWPROC) msg->lParam))
+                return 0; /* invalid winproc */
+
 	    return CallWindowProcW( (WNDPROC)msg->lParam, msg->hwnd,
                                    msg->message, msg->wParam, GetTickCount() );
         }
diff --git a/windows/timer.c b/windows/timer.c
index 4da21f18135..126ef16850f 100644
--- a/windows/timer.c
+++ b/windows/timer.c
@@ -316,6 +316,30 @@ UINT WINAPI SetTimer( HWND hwnd, UINT id, UINT timeout,
 }
 
 
+/***********************************************************************
+ *           TIMER_IsTimerValid
+ */
+BOOL TIMER_IsTimerValid( HWND hwnd, UINT id, HWINDOWPROC hProc )
+{
+    int i;
+    TIMER *pTimer;
+    BOOL ret = FALSE;
+
+    EnterCriticalSection( &csTimer );
+    
+    for (i = 0, pTimer = TimersArray; i < NB_TIMERS; i++, pTimer++)
+        if ((pTimer->hwnd == hwnd) && (pTimer->id == id) &&
+            (pTimer->proc == hProc))
+        {
+            ret = TRUE;
+            break;
+        }
+
+   LeaveCriticalSection( &csTimer );
+   return ret;
+}
+
+
 /***********************************************************************
  *           SetSystemTimer16   (USER.11)
  */