Watch out for DefMDIChildProc calls on non-MDI-child windows.
diff --git a/windows/mdi.c b/windows/mdi.c
index 3d9aec2..1e262ed 100644
--- a/windows/mdi.c
+++ b/windows/mdi.c
@@ -75,6 +75,7 @@
#include "winuser.h"
#include "wine/unicode.h"
#include "win.h"
+#include "class.h"
#include "heap.h"
#include "nonclient.h"
#include "mdi.h"
@@ -1645,6 +1646,14 @@
ci = (MDICLIENTINFO *) clientWnd->wExtra;
WIN_ReleaseWndPtr(tmpWnd);
+ /* Sanity check */
+ if (clientWnd->class->cbWndExtra < sizeof(MDICLIENTINFO))
+ {
+ WARN("called on non-MDI child window %x\n", hwnd);
+ WIN_ReleaseWndPtr(clientWnd);
+ return DefWindowProc16(hwnd, message, wParam, lParam);
+ }
+
switch (message)
{
case WM_SETTEXT:
@@ -1837,6 +1846,14 @@
ci = (MDICLIENTINFO *) clientWnd->wExtra;
WIN_ReleaseWndPtr(tmpWnd);
+ /* Sanity check */
+ if (clientWnd->class->cbWndExtra < sizeof(MDICLIENTINFO))
+ {
+ WARN("called on non-MDI child window %x\n", hwnd);
+ WIN_ReleaseWndPtr(clientWnd);
+ return DefWindowProcA(hwnd, message, wParam, lParam);
+ }
+
switch (message)
{
case WM_SETTEXT:
@@ -1907,6 +1924,14 @@
ci = (MDICLIENTINFO *) clientWnd->wExtra;
WIN_ReleaseWndPtr(tmpWnd);
+ /* Sanity check */
+ if (clientWnd->class->cbWndExtra < sizeof(MDICLIENTINFO))
+ {
+ WARN("called on non-MDI child window %x\n", hwnd);
+ WIN_ReleaseWndPtr(clientWnd);
+ return DefWindowProcW(hwnd, message, wParam, lParam);
+ }
+
switch (message)
{
case WM_SETTEXT: