fixed accessing memory that has already been freed

reactos/subsys/win32k/ntuser

diff -u -r1.76 -r1.77
--- msgqueue.c	11 Mar 2004 16:17:25 -0000	1.76
+++ msgqueue.c	23 Mar 2004 22:24:27 -0000	1.77
@@ -16,7 +16,7 @@

  *  along with this program; if not, write to the Free Software
  *  Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  */

-/* $Id: msgqueue.c,v 1.76 2004/03/11 16:17:25 weiden Exp $

+/* $Id: msgqueue.c,v 1.77 2004/03/23 22:24:27 weiden Exp $

  *
  * COPYRIGHT:        See COPYING in the top level directory
  * PROJECT:          ReactOS kernel

@@ -240,7 +240,7 @@

 
 BOOL STATIC STDCALL
 MsqTranslateMouseMessage(HWND hWnd, UINT FilterLow, UINT FilterHigh,

-			 PUSER_MESSAGE Message, BOOL Remove, PBOOL Freed,

+			 PUSER_MESSAGE Message, BOOL Remove, PBOOL Freed, BOOL RemoveWhenFreed,

 			 PWINDOW_OBJECT ScopeWin, PUSHORT HitTest,
 			 PPOINT ScreenPoint, BOOL FromGlobalQueue)
 {

@@ -298,6 +298,10 @@

         else
         {
           IntReleaseWindowObject(Window);

+          if(RemoveWhenFreed)
+          {
+            RemoveEntryList(&Message->ListEntry);
+          }

           ExFreePool(Message);
           *Freed = TRUE;
           return(FALSE);

@@ -346,6 +350,10 @@

 
   if (Window == NULL)
   {

+    if(RemoveWhenFreed)
+    {
+      RemoveEntryList(&Message->ListEntry);
+    }

     ExFreePool(Message);
     *Freed = TRUE;
     return(FALSE);

@@ -377,6 +385,10 @@

     {
       /* we do not hold more than one WM_MOUSEMOVE message in the queue */
       Window->MessageQueue->MouseMoveMsg->Msg = Message->Msg;

+      if(RemoveWhenFreed)
+      {
+        RemoveEntryList(&Message->ListEntry);
+      }

       ExFreePool(Message);
       *Freed = TRUE;
     }

@@ -404,6 +416,10 @@

     {
       /* we do not hold more than one WM_MOUSEMOVE message in the queue */
       Window->MessageQueue->MouseMoveMsg->Msg = Message->Msg;

+      if(RemoveWhenFreed)
+      {
+        RemoveEntryList(&Message->ListEntry);
+      }

       ExFreePool(Message);
       *Freed = TRUE;
     }

@@ -527,7 +543,7 @@

 	  Current->Msg.message <= WM_MOUSELAST)
 	{
 	  Accept = MsqTranslateMouseMessage(hWnd, FilterLow, FilterHigh,

-					    Current, Remove, &Freed,

+					    Current, Remove, &Freed, TRUE,

 					    DesktopWindow, &HitTest,
 					    &ScreenPoint, FALSE);
 	  if (Accept)

@@ -546,9 +562,7 @@

 	      IntReleaseWindowObject(DesktopWindow);
 	      return(TRUE);
 	    }

-	  
-	  if(Freed)
-	    RemoveEntryList(&Current->ListEntry);

+

 	}
     }
   IntUnLockHardwareMessageQueue(MessageQueue);

@@ -598,7 +612,7 @@

 	  const ULONG ActiveStamp = HardwareMessageQueueStamp;
 	  /* Translate the message. */
 	  Accept = MsqTranslateMouseMessage(hWnd, FilterLow, FilterHigh,

-					    Current, Remove, &Freed,

+					    Current, Remove, &Freed, FALSE,

 					    DesktopWindow, &HitTest,
 					    &ScreenPoint, TRUE);
 	  if (Accept)