https://git.reactos.org/?p=reactos.git;a=commitdiff;h=e3c8002dfc79e478a6d156c52abd4e243d36d754
commit e3c8002dfc79e478a6d156c52abd4e243d36d754 Author: Thomas Faber <[email protected]> AuthorDate: Fri Dec 28 13:39:23 2018 +0100 Commit: Thomas Faber <[email protected]> CommitDate: Sun Dec 30 00:25:01 2018 +0100 [WIN32K:NTUSER] Reference menus owned by a popup menu. CORE-15504 --- win32ss/user/ntuser/menu.c | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/win32ss/user/ntuser/menu.c b/win32ss/user/ntuser/menu.c index 6c825f3f10..0dc6bac375 100644 --- a/win32ss/user/ntuser/menu.c +++ b/win32ss/user/ntuser/menu.c @@ -4512,6 +4512,10 @@ PopupMenuWndProc( { CREATESTRUCTW *cs = (CREATESTRUCTW *) lParam; pPopupMenu->spmenu = UserGetMenuObject(cs->lpCreateParams); + if (pPopupMenu->spmenu) + { + UserReferenceObject(pPopupMenu->spmenu); + } break; } @@ -4556,6 +4560,10 @@ PopupMenuWndProc( case WM_NCDESTROY: { + if (pPopupMenu->spmenu) + { + IntReleaseMenuObject(pPopupMenu->spmenu); + } DesktopHeapFree(Wnd->head.rpdesk, pPopupMenu ); ((PMENUWND)Wnd)->ppopupmenu = 0; Wnd->fnid = FNID_DESTROY; @@ -4571,6 +4579,11 @@ PopupMenuWndProc( ERR("Bad Menu Handle\n"); break; } + UserReferenceObject(pmenu); + if (pPopupMenu->spmenu) + { + IntReleaseMenuObject(pPopupMenu->spmenu); + } pPopupMenu->spmenu = pmenu; break; }
