Author: jimtabor Date: Tue Aug 2 04:05:16 2016 New Revision: 72080
URL: http://svn.reactos.org/svn/reactos?rev=72080&view=rev Log: [NtUser] - Fix crash while mouse cursor is moving over stress test window (RegEdit). This fixes VLC too. Tested SeaMonkey and it did not crash. See CORE-9169 and CORE-9836.
Modified: trunk/reactos/win32ss/user/ntuser/cursoricon.c trunk/reactos/win32ss/user/ntuser/cursoricon.h trunk/reactos/win32ss/user/ntuser/defwnd.c trunk/reactos/win32ss/user/ntuser/msgqueue.c
Modified: trunk/reactos/win32ss/user/ntuser/cursoricon.c URL: http://svn.reactos.org/svn/reactos/trunk/reactos/win32ss/user/ntuser/cursori... ============================================================================== --- trunk/reactos/win32ss/user/ntuser/cursoricon.c [iso-8859-1] (original) +++ trunk/reactos/win32ss/user/ntuser/cursoricon.c [iso-8859-1] Tue Aug 2 04:05:16 2016 @@ -224,6 +224,15 @@
ASSERT(CurIcon->head.cLockObj >= 1); return CurIcon; +} + +PCURICON_OBJECT +IntSystemSetCursor(PCURICON_OBJECT pcurNew) +{ + PCURICON_OBJECT pcurOld = UserSetCursor(pcurNew, FALSE); + UserReferenceObject(pcurNew); + if (pcurOld) UserDereferenceObject(pcurOld); + return pcurOld; }
BOOL UserSetCursorPos( INT x, INT y, DWORD flags, ULONG_PTR dwExtraInfo, BOOL Hook) @@ -1062,9 +1071,12 @@ }
pcurOld = UserSetCursor(pcurNew, FALSE); - if (pcurOld) - { - hOldCursor = pcurOld->head.h; + + // If returning an old cursor than validate it, Justin Case! + if ( pcurOld && + (pcurOld = UserGetObjectNoErr(gHandleTable, UserHMGetHandle(pcurOld), TYPE_CURSOR))) + { + hOldCursor = UserHMGetHandle(pcurOld); /* Problem:
@@ -1078,12 +1090,12 @@ { TRACE("Returning Global Cursor hcur %p\n",hOldCursor);
- if (pcurOld->head.cLockObj > 2) // Throttle down to 2. + /*if (pcurOld->head.cLockObj > 2) // Throttle down to 2. { UserDereferenceObject(pcurOld); }
- goto leave; + goto leave;*/ }
/* See if it was destroyed in the meantime */
Modified: trunk/reactos/win32ss/user/ntuser/cursoricon.h URL: http://svn.reactos.org/svn/reactos/trunk/reactos/win32ss/user/ntuser/cursori... ============================================================================== --- trunk/reactos/win32ss/user/ntuser/cursoricon.h [iso-8859-1] (original) +++ trunk/reactos/win32ss/user/ntuser/cursoricon.h [iso-8859-1] Tue Aug 2 04:05:16 2016 @@ -140,8 +140,6 @@ BOOL UserSetCursorPos( INT x, INT y, DWORD flags, ULONG_PTR dwExtraInfo, BOOL Hook); BOOL APIENTRY UserClipCursor(RECTL *prcl); PSYSTEM_CURSORINFO IntGetSysCursorInfo(VOID); - -#define IntReleaseCurIconObject(CurIconObj) \ - UserDereferenceObject(CurIconObj) +PCURICON_OBJECT IntSystemSetCursor(PCURICON_OBJECT);
/* EOF */
Modified: trunk/reactos/win32ss/user/ntuser/defwnd.c URL: http://svn.reactos.org/svn/reactos/trunk/reactos/win32ss/user/ntuser/defwnd.... ============================================================================== --- trunk/reactos/win32ss/user/ntuser/defwnd.c [iso-8859-1] (original) +++ trunk/reactos/win32ss/user/ntuser/defwnd.c [iso-8859-1] Tue Aug 2 04:05:16 2016 @@ -307,7 +307,7 @@ { if (pWnd->pcls->spcur) { - UserSetCursor(pWnd->pcls->spcur, FALSE); + IntSystemSetCursor(pWnd->pcls->spcur); } return FALSE; } @@ -319,7 +319,7 @@ { break; } - UserSetCursor(SYSTEMCUR(SIZEWE), FALSE); + IntSystemSetCursor(SYSTEMCUR(SIZEWE)); return TRUE; }
@@ -330,7 +330,7 @@ { break; } - UserSetCursor(SYSTEMCUR(SIZENS), FALSE); + IntSystemSetCursor(SYSTEMCUR(SIZENS)); return TRUE; }
@@ -341,7 +341,7 @@ { break; } - UserSetCursor(SYSTEMCUR(SIZENWSE), FALSE); + IntSystemSetCursor(SYSTEMCUR(SIZENWSE)); return TRUE; }
@@ -352,11 +352,11 @@ { break; } - UserSetCursor(SYSTEMCUR(SIZENESW), FALSE); + IntSystemSetCursor(SYSTEMCUR(SIZENESW)); return TRUE; } } - UserSetCursor(SYSTEMCUR(ARROW), FALSE); + IntSystemSetCursor(SYSTEMCUR(ARROW)); return FALSE; }
Modified: trunk/reactos/win32ss/user/ntuser/msgqueue.c URL: http://svn.reactos.org/svn/reactos/trunk/reactos/win32ss/user/ntuser/msgqueu... ============================================================================== --- trunk/reactos/win32ss/user/ntuser/msgqueue.c [iso-8859-1] (original) +++ trunk/reactos/win32ss/user/ntuser/msgqueue.c [iso-8859-1] Tue Aug 2 04:05:16 2016 @@ -1516,7 +1516,7 @@ if (pwndMsg == NULL || pwndMsg->head.pti->MessageQueue != MessageQueue) { // Crossing a boundary, so set cursor. See default message queue cursor. - UserSetCursor(SYSTEMCUR(ARROW), FALSE); + IntSystemSetCursor(SYSTEMCUR(ARROW)); /* Remove and ignore the message */ *RemoveMessages = TRUE; return FALSE;