https://git.reactos.org/?p=reactos.git;a=commitdiff;h=77d46531648c244b6eec2…
commit 77d46531648c244b6eec2cdb75a710d4e8ffd8cb
Author: Thamatip Chitpong <tangaming123456(a)outlook.com>
AuthorDate: Thu Apr 13 03:20:46 2023 +0700
Commit: GitHub <noreply(a)github.com>
CommitDate: Wed Apr 12 22:20:46 2023 +0200
[NTUSER] co_UserDestroyWindow: Validate window before destroying it (#5054)
Prevent the window from being destroyed twice
fixes BSOD 0x1E CORE-18821
---
win32ss/user/ntuser/window.c | 9 +++++++++
1 file changed, 9 insertions(+)
diff --git a/win32ss/user/ntuser/window.c b/win32ss/user/ntuser/window.c
index f8bc4e539c2..7bc57864b78 100644
--- a/win32ss/user/ntuser/window.c
+++ b/win32ss/user/ntuser/window.c
@@ -2845,6 +2845,15 @@ BOOLEAN co_UserDestroyWindow(PVOID Object)
ASSERT_REFS_CO(Window); // FIXME: Temp HACK?
+ /* NtUserDestroyWindow does check if the window has already been destroyed
+ but co_UserDestroyWindow can be called from more paths which means
+ that it can also be called for a window that has already been destroyed. */
+ if (!IntIsWindow(UserHMGetHandle(Window)))
+ {
+ TRACE("Tried to destroy a window twice\n");
+ return TRUE;
+ }
+
hWnd = Window->head.h;
ti = PsGetCurrentThreadWin32Thread();