[tfaber] 69677: [WIN32K:NTUSER] - In UserAttachThreadInput, copy the CaretInfo structure instead of saving a pointer that may be freed right after CORE-10395 #resolve

Author: tfaber
Date: Sat Oct 24 15:04:12 2015
New Revision: 69677

URL: http://svn.reactos.org/svn/reactos?rev=69677&view=rev
Log:
[WIN32K:NTUSER]
- In UserAttachThreadInput, copy the CaretInfo structure instead of saving a pointer that
may be freed right after
CORE-10395 #resolve

Modified:
    trunk/reactos/win32ss/user/ntuser/input.c

Modified: trunk/reactos/win32ss/user/ntuser/input.c
URL:
http://svn.reactos.org/svn/reactos/trunk/reactos/win32ss/user/ntuser/input.…
==============================================================================
--- trunk/reactos/win32ss/user/ntuser/input.c	[iso-8859-1] (original)
+++ trunk/reactos/win32ss/user/ntuser/input.c	[iso-8859-1] Sat Oct 24 15:04:12 2015
@@ -524,7 +524,9 @@
               ptiTo->MessageQueue->spwndFocus   =
ptiFrom->MessageQueue->spwndFocus;
               ptiTo->MessageQueue->spwndCapture =
ptiFrom->MessageQueue->spwndCapture;
               ptiTo->MessageQueue->QF_flags    ^=
((ptiTo->MessageQueue->QF_flags ^ ptiFrom->MessageQueue->QF_flags) &
QF_CAPTURELOCKED);
-              ptiTo->MessageQueue->CaretInfo    =
ptiFrom->MessageQueue->CaretInfo;
+              RtlCopyMemory(ptiTo->MessageQueue->CaretInfo,
+                            ptiFrom->MessageQueue->CaretInfo,
+                            sizeof(ptiTo->MessageQueue->CaretInfo));
               IntSetFocusMessageQueue(NULL);
               IntSetFocusMessageQueue(ptiTo->MessageQueue);
               gptiForeground = ptiTo;