From 2ef929b5132101275440378f6f8cade3dfb8709e Mon Sep 17 00:00:00 2001
From: anders_k <anders_k@212acab6-be3b-0410-9dea-997c60f758d6>
Date: Sat, 1 Aug 2020 01:40:47 +0000
Subject: [PATCH] Fixed SetBrandingImage crash

git-svn-id: https://svn.code.sf.net/p/nsis/code/NSIS/trunk@7205 212acab6-be3b-0410-9dea-997c60f758d6
---
 Docs/src/history.but  | 10 ++++++++++
 Source/exehead/exec.c |  2 +-
 Source/script.cpp     | 17 +++++++++--------
 3 files changed, 20 insertions(+), 9 deletions(-)

diff --git a/Docs/src/history.but b/Docs/src/history.but
index c696b0e1..2b2f41b5 100644
--- a/Docs/src/history.but
+++ b/Docs/src/history.but
@@ -1,5 +1,15 @@
 \A{history} Changelog and Release Notes
 
+\H{v3.06.1} 3.06.1
+
+Released on July 31st, 2020
+
+\S1{v3.06.1-cl} Changelog
+
+\S2{} Major Changes
+
+\b Fixed SetBrandingImage crash
+
 \H{v3.06} 3.06
 
 Released on July 31st, 2020
diff --git a/Source/exehead/exec.c b/Source/exehead/exec.c
index 65e598a9..4fac1579 100644
--- a/Source/exehead/exec.c
+++ b/Source/exehead/exec.c
@@ -851,7 +851,7 @@ static int NSISCALL ExecuteEntry(entry *entry_)
       hNewImage=LoadImage(exeres ? g_hInstance : NULL, imgid, it, fitw*r.right, fith*r.bottom, parm3 & LASIM_LR);
       hPrevImage=(HANDLE)SendMessage(hCtl, STM_SETIMAGE, it, (LPARAM)hNewImage);
       if (hPrevImage && IMAGE_BITMAP == it) DeleteObject(hPrevImage); // Delete the old bitmap
-      if (parm0 >=0) iptrtostr(var0, (INT_PTR)hNewImage); // Optional output handle
+      if (parm0 >= 0) iptrtostr(var0, (INT_PTR)hNewImage); // Optional output handle
     }
     break;
     case EW_CREATEFONT:
diff --git a/Source/script.cpp b/Source/script.cpp
index 92800a03..e6d9611b 100644
--- a/Source/script.cpp
+++ b/Source/script.cpp
@@ -4894,15 +4894,15 @@ int CEXEBuild::doCommand(int which_token, LineParser &line)
       ent.which=EW_LOADANDSETIMAGE;
       for (int i = 1; i < line.getnumtokens(); i++)
         if (!_tcsnicmp(line.gettoken_str(i),_T("/IMGID="),7)) {
-          ent.offsets[1]=_ttoi(line.gettoken_str(i)+7);
-          SCRIPT_MSG(_T("/IMGID=%d "),ent.offsets[1]);
+          ent.offsets[2]=_ttoi(line.gettoken_str(i)+7);
+          SCRIPT_MSG(_T("/IMGID=%d "),ent.offsets[2]);
         }
         else if (!_tcsicmp(line.gettoken_str(i),_T("/RESIZETOFIT"))) {
-          ent.offsets[2]=LASIF_FITCTLW|LASIF_FITCTLH;
+          ent.offsets[3]=LASIF_FITCTLW|LASIF_FITCTLH;
           SCRIPT_MSG(_T("/RESIZETOFIT "));
         }
-        else if (!ent.offsets[0]) {
-          ent.offsets[0]=add_string(line.gettoken_str(i));
+        else if (!ent.offsets[1]) {
+          ent.offsets[1]=add_string(line.gettoken_str(i));
           SCRIPT_MSG(_T("\"%") NPRIs _T("\" "), line.gettoken_str(i));
         }
         else {
@@ -4910,15 +4910,16 @@ int CEXEBuild::doCommand(int which_token, LineParser &line)
           PRINTHELP();
         }
       SCRIPT_MSG(_T("\n"));
-      if (!ent.offsets[1])
+      if (!ent.offsets[2])
       {
-        ent.offsets[1]=branding_image_id;
+        ent.offsets[2]=branding_image_id;
         if (!branding_image_found) {
           ERROR_MSG(_T("\nError: no branding image found in chosen UI!\n"));
           return PS_ERROR;
         }
       }
-      ent.offsets[2]|=LASIF_LR_LOADFROMFILE|LASIF_STRID;
+      ent.offsets[0]=-1; // Outvar
+      ent.offsets[3]|=LASIF_LR_LOADFROMFILE|LASIF_STRID;
     }
     return add_entry(&ent);
     case TOK_LOADANDSETIMAGE: