Before calling the timer window proc, make sure it is valid.

include/message.h

@@ -9,6 +9,7 @@
 
 #include "windef.h"
 #include "wine/windef16.h"
+#include "winproc.h"
 
 struct tagMSG;
 
@@ -22,6 +23,7 @@ extern void TIMER_RemoveWindowTimers( HWND hwnd );
 extern void TIMER_RemoveQueueTimers( HQUEUE16 hqueue );
 extern BOOL TIMER_GetTimerMsg( struct tagMSG *msg, HWND hwnd,
                                  HQUEUE16 hQueue, BOOL remove );
+extern BOOL TIMER_IsTimerValid( HWND hwnd, UINT id, HWINDOWPROC hProc );
 
 /* event.c */
 extern void EVENT_Synchronize( void );

windows/message.c

@@ -2283,6 +2283,12 @@ LONG WINAPI DispatchMessage16( const MSG16* msg )
     {
 	if (msg->lParam)
         {
+            /* before calling window proc, verify it the timer is still valid,
+               there's a slim chance the application kill the timer between
+               getMessage and DisaptachMessage API calls */
+            if (!TIMER_IsTimerValid(msg->hwnd, (UINT) msg->wParam, (HWINDOWPROC) msg->lParam))
+                return 0; /* invalid winproc */
+
 	    return CallWindowProc16( (WNDPROC16)msg->lParam, msg->hwnd,
                                    msg->message, msg->wParam, GetTickCount() );
         }
@@ -2359,6 +2365,13 @@ LONG WINAPI DispatchMessageA( const MSG* msg )
 	if (msg->lParam)
         {
 /*            HOOK_CallHooks32A( WH_CALLWNDPROC, HC_ACTION, 0, FIXME ); */
+
+            /* before calling window proc, verify it the timer is still valid,
+               there's a slim chance the application kill the timer between
+               getMessage and DisaptachMessage API calls */
+            if (!TIMER_IsTimerValid(msg->hwnd, (UINT) msg->wParam, (HWINDOWPROC) msg->lParam))
+                return 0; /* invalid winproc */
+
 	    return CallWindowProcA( (WNDPROC)msg->lParam, msg->hwnd,
                                    msg->message, msg->wParam, GetTickCount() );
         }
@@ -2434,6 +2447,13 @@ LONG WINAPI DispatchMessageW( const MSG* msg )
 	if (msg->lParam)
         {
 /*            HOOK_CallHooks32W( WH_CALLWNDPROC, HC_ACTION, 0, FIXME ); */
+
+            /* before calling window proc, verify it the timer is still valid,
+               there's a slim chance the application kill the timer between
+               getMessage and DisaptachMessage API calls */
+            if (!TIMER_IsTimerValid(msg->hwnd, (UINT) msg->wParam, (HWINDOWPROC) msg->lParam))
+                return 0; /* invalid winproc */
+
 	    return CallWindowProcW( (WNDPROC)msg->lParam, msg->hwnd,
                                    msg->message, msg->wParam, GetTickCount() );
         }

windows/timer.c

@@ -316,6 +316,30 @@ UINT WINAPI SetTimer( HWND hwnd, UINT id, UINT timeout,
 }
 
 
+/***********************************************************************
+ *           TIMER_IsTimerValid
+ */
+BOOL TIMER_IsTimerValid( HWND hwnd, UINT id, HWINDOWPROC hProc )
+{
+    int i;
+    TIMER *pTimer;
+    BOOL ret = FALSE;
+
+    EnterCriticalSection( &csTimer );
+    
+    for (i = 0, pTimer = TimersArray; i < NB_TIMERS; i++, pTimer++)
+        if ((pTimer->hwnd == hwnd) && (pTimer->id == id) &&
+            (pTimer->proc == hProc))
+        {
+            ret = TRUE;
+            break;
+        }
+
+   LeaveCriticalSection( &csTimer );
+   return ret;
+}
+
+
 /***********************************************************************
  *           SetSystemTimer16   (USER.11)
  */