FNC UI Pack 7.3.1.4
Hello,
I would like to report a 64-bit bug in TMS FNC UI Pack 7.3.1.4 with Delphi 13 (compiler 37.0), VCL, Win64. The unit is VCL.TMSFNCButton, version 1.0.1.3.
In TTMSFNCButton.SetText, line 797:
SendMessage(Handle, WM_SETTEXT, 0, Integer(PChar('')));
The Integer cast truncates the pointer to 32 bits. When the literal is located above 4 GB (the normal case with high-entropy ASLR), the sign-extended value is an invalid address and USER32 raises an access violation:
EAccessViolation: Access violation at address 00007FFC30F37949 in module 'USER32.dll'. Read of address FFFFFFFFE09ED464
The code only runs when the button already has a window handle, so setting Text before the control has a parent hides the problem.
To reproduce, in a Win64 VCL application:
b := TTMSFNCButton.Create(Form);
b.Parent := Form;
b.HandleNeeded;
b.Text := 'New text'; // AV
Fix: replace the cast with LPARAM, which is pointer-sized:
SendMessage(Handle, WM_SETTEXT, 0, LPARAM(PChar('')));
I applied this locally, rebuilt the unit, and the access violation no longer occurs. The same line appears in FMX.TMSFNCButton.pas, LCLTMSFNCButton.pas and WEBLib.TMSFNCButton.pas, inside the VCLLIB block, so it is only active for VCL.
The same pattern exists in TMS Query Studio 1.19, atParamTreeView.pas, at lines 1927 (Integer(PChar(Temp))) and 1975 (lParam := Integer(Self)). I found this by reading the source and have not tested it.