On 30-Dec-07, at 6:12 PM, greatlrd@svn.reactos.org wrote:

+        pSurfacelcl = (PDD_SURFACE_LOCAL)(((PBYTE)&pSurfacelcl) + sizeof(DD_BASEOBJECT));
    

This code makes absolutely no sense. You do realize you're returning a stack address, right?

Best regards,
Alex Ionescu