[Solved] CXTPMarkupListBox crashes on empty list

Message Topic Search Topic Options Post Reply Create New Topic Printable Version Translate Topic

   Version : 15.x 16.x and maybe newer versions

Symptoms : CXTPMarkupListBox and CXTPListBox crashes when the list box is empty and move mouse inside its client area.

Problem : 
Inside  void CXTPListBox::OnMouseMove(UINT nFlags, CPoint point)
the MFC function ItemFromPoint() returns a WORD (not signed) value of 65535 which means invalid or empty list. This value is returned to nHotItem.

int nHotItem = ItemFromPoint(point, bOutside) 

The signed int nHotItem is now 4 bytes so instead of converting the non signed word 65535 to -1, it remains 65535. After this, the code is calling 

BOOL CXTPMarkupListBox::OnWndMsg(UINT message, WPARAM wParam, LPARAM lParam, LRESULT* pResult) 

which in turn is calling an invalid item in  code below.

XTP_MARKUP_LISTITEM *pItem = reinterpret_cast<XTP_MARKUP_LISTITEM*>(GetItemDataPtr(m_nHotItem));

At this point the code crashes.

Solution

Inside void CXTPListBox::OnMouseMove(UINT nFlags, CPoint point)

declare nHotItem as short int instead of an int like below. 

short int nHotItem = ItemFromPoint(point, bOutside) 

Recompile all codejock libs and rebuild your project.