https://git.reactos.org/?p=reactos.git;a=commitdiff;h=bd027c9de4dca4ef53f9d…
commit bd027c9de4dca4ef53f9d8f3233749de3d25a4f2
Author: Doug Lyons <douglyons(a)douglyons.com>
AuthorDate: Mon Oct 3 17:26:02 2022 -0500
Commit: GitHub <noreply(a)github.com>
CommitDate: Tue Oct 4 00:26:02 2022 +0200
[NTUSER] Fix 'Trying to link windows to itself' (#4478) CORE-18132
Fix 'Trying to link windows to itself' on DestroyWindow. Patch by
I_Kill_Bugs.
This fixes a potential BSOD 0x50 observable in the app Localizer Editor"
---
win32ss/user/ntuser/winpos.c | 30 ++++++++++++++++++++++++++++--
1 file changed, 28 insertions(+), 2 deletions(-)
diff --git a/win32ss/user/ntuser/winpos.c b/win32ss/user/ntuser/winpos.c
index 7795f0293b6..25c13b48102 100644
--- a/win32ss/user/ntuser/winpos.c
+++ b/win32ss/user/ntuser/winpos.c
@@ -1393,8 +1393,34 @@ WinPosDoOwnedPopups(PWND Window, HWND hWndInsertAfter)
if (List[i] == Owner)
{
- if (i > 0) hWndInsertAfter = List[i-1];
- else hWndInsertAfter = topmost ? HWND_TOPMOST : HWND_TOP;
+ /* We found its Owner, so we must handle it here. */
+ if (i > 0)
+ {
+ if (List[i - 1] != UserHMGetHandle(Window))
+ {
+ /*
+ * If the popup to be inserted is not already just
+ * before the Owner, insert it there. The modified
+ * hWndInsertAfter will be handled below.
+ *
+ * (NOTE: Do not allow hWndInsertAfter to become equal
+ * to the popup's window handle, as this would cause
+ * the popup to link to itself).
+ */
+ hWndInsertAfter = List[i - 1];
+ }
+ else
+ {
+ /* If the popup to be inserted is already
+ * before the Owner, we are done. */
+ ExFreePoolWithTag(List, USERTAG_WINDOWLIST);
+ return hWndInsertAfter;
+ }
+ }
+ else
+ {
+ hWndInsertAfter = topmost ? HWND_TOPMOST : HWND_TOP;
+ }
break;
}