[reactos] 01/01: [WIN32K:NTUSER] Reference menus owned by a popup menu. CORE-15504

[Thomas Faber]

https://git.reactos.org/?p=reactos.git;a=commitdiff;h=e3c8002dfc79e478a6d15…

commit e3c8002dfc79e478a6d156c52abd4e243d36d754
Author:     Thomas Faber <thomas.faber(a)reactos.org>
AuthorDate: Fri Dec 28 13:39:23 2018 +0100
Commit:     Thomas Faber <thomas.faber(a)reactos.org>
CommitDate: Sun Dec 30 00:25:01 2018 +0100

    [WIN32K:NTUSER] Reference menus owned by a popup menu. CORE-15504
---
 win32ss/user/ntuser/menu.c | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/win32ss/user/ntuser/menu.c b/win32ss/user/ntuser/menu.c
index 6c825f3f10..0dc6bac375 100644
--- a/win32ss/user/ntuser/menu.c
+++ b/win32ss/user/ntuser/menu.c
@@ -4512,6 +4512,10 @@ PopupMenuWndProc(
       {
         CREATESTRUCTW *cs = (CREATESTRUCTW *) lParam;
         pPopupMenu->spmenu = UserGetMenuObject(cs->lpCreateParams);
+        if (pPopupMenu->spmenu)
+        {
+           UserReferenceObject(pPopupMenu->spmenu);
+        }
         break;
       }
 
@@ -4556,6 +4560,10 @@ PopupMenuWndProc(
 
     case WM_NCDESTROY:
       {
+         if (pPopupMenu->spmenu)
+         {
+            IntReleaseMenuObject(pPopupMenu->spmenu);
+         }
          DesktopHeapFree(Wnd->head.rpdesk, pPopupMenu );
          ((PMENUWND)Wnd)->ppopupmenu = 0;
          Wnd->fnid = FNID_DESTROY;
@@ -4571,6 +4579,11 @@ PopupMenuWndProc(
            ERR("Bad Menu Handle\n");
            break;
         }
+        UserReferenceObject(pmenu);
+        if (pPopupMenu->spmenu)
+        {
+           IntReleaseMenuObject(pPopupMenu->spmenu);
+        }
         pPopupMenu->spmenu = pmenu;
         break;
       }