From 0f86e212b1a2cb85784aabbee40891f86b6c53c2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?G=C3=A9=20van=20Geldorp?= <ge@gse.nl>
Date: Mon, 3 Jan 2005 09:46:31 +0000
Subject: [PATCH] Fix ref counting bug

svn path=/trunk/; revision=12749
---
 reactos/subsys/win32k/ntuser/cursoricon.c | 24 +++++++++++++----------
 1 file changed, 14 insertions(+), 10 deletions(-)

diff --git a/reactos/subsys/win32k/ntuser/cursoricon.c b/reactos/subsys/win32k/ntuser/cursoricon.c
index b456b72cdcb..40a27a67d98 100644
--- a/reactos/subsys/win32k/ntuser/cursoricon.c
+++ b/reactos/subsys/win32k/ntuser/cursoricon.c
@@ -343,21 +343,25 @@ IntFindExistingCurIconObject(PWINSTATION_OBJECT WinStaObject, HMODULE hModule,
   {
     Object = CONTAINING_RECORD(CurrentEntry, CURICON_OBJECT, ListEntry);
     CurrentEntry = CurrentEntry->Flink;
-    if((Object->hModule == hModule) && (Object->hRsrc == hRsrc))
+    if(NT_SUCCESS(ObmReferenceObjectByPointer(Object, otCursorIcon)))
     {
-      if(cx && ((cx != Object->Size.cx) || (cy != Object->Size.cy)))
-      {
-        ObmDereferenceObject(Object);
-	continue;
-      }
-      if (! ReferenceCurIconByProcess(Object))
+      if((Object->hModule == hModule) && (Object->hRsrc == hRsrc))
       {
+        if(cx && ((cx != Object->Size.cx) || (cy != Object->Size.cy)))
+        {
+          ObmDereferenceObject(Object);
+          continue;
+        }
+        if (! ReferenceCurIconByProcess(Object))
+        {
+          ExReleaseFastMutex(&CurIconListLock);
+          return NULL;
+        }
         ExReleaseFastMutex(&CurIconListLock);
-        return NULL;
+        return Object;
       }
-      ExReleaseFastMutex(&CurIconListLock);
-      return Object;
     }
+    ObmDereferenceObject(Object);
   }
   
   ExReleaseFastMutex(&CurIconListLock);