Better handling of bad data in TabbedTextOut/TabbedTextExtent
Checked with:
a) Null tabstop array with non-zero number of entries
b) Negative number of entries (MSDN is wrong; it is not an error)
c) Single tabwidth of negative size
d) Single specified tabwidth of zero size

diff --git a/dlls/user/text.c b/dlls/user/text.c
index 04cbb91..c46dfc1 100644
--- a/dlls/user/text.c
+++ b/dlls/user/text.c
@@ -1216,7 +1216,10 @@
     extent.cx = 0;
     extent.cy = 0;
 
-    if (cTabStops == 1)
+    if (!lpTabPos)
+        cTabStops=0;
+
+    if (cTabStops == 1 && *lpTabPos >= /* sic */ 0)
     {
         defWidth = *lpTabPos;
         cTabStops = 0;
@@ -1226,6 +1229,8 @@
         TEXTMETRICA tm;
         GetTextMetricsA( hdc, &tm );
         defWidth = 8 * tm.tmAveCharWidth;
+        if (cTabStops == 1)
+            cTabStops = 0; /* on negative *lpTabPos */
     }
 
     while (count > 0)
@@ -1243,6 +1248,8 @@
             tabPos = x + extent.cx;
         else if (cTabStops > 0)
             tabPos = nTabOrg + *lpTabPos;
+        else if (defWidth <= 0)
+            tabPos = x + extent.cx;
         else
             tabPos = nTabOrg + ((x + extent.cx - nTabOrg) / defWidth + 1) * defWidth;
         if (fDisplayText)