From 392a9398e283f15b884ee01f0a1431cf1d437c30 Mon Sep 17 00:00:00 2001
From: Amine Khaldi <amine.khaldi@reactos.org>
Date: Wed, 27 Jul 2016 15:21:39 +0000
Subject: [PATCH] [0.4.2] * Apply the hackfix from CORE-9836 by Joachim Henze.

svn path=/branches/ros-branch-0_4_2/; revision=72018
---
 reactos/win32ss/user/ntuser/class.c      | 5 ++++-
 reactos/win32ss/user/ntuser/cursoricon.c | 9 ++++++---
 reactos/win32ss/user/ntuser/msgqueue.c   | 8 ++++++--
 3 files changed, 16 insertions(+), 6 deletions(-)

diff --git a/reactos/win32ss/user/ntuser/class.c b/reactos/win32ss/user/ntuser/class.c
index 42367a94ed9..a132c7da312 100644
--- a/reactos/win32ss/user/ntuser/class.c
+++ b/reactos/win32ss/user/ntuser/class.c
@@ -267,8 +267,11 @@ IntDestroyClass(IN OUT PCLS Class)
 
     if (Class->spicn)
         UserDereferenceObject(Class->spicn);
-    if (Class->spcur)
+    if (Class->spcur && !UserObjectInDestroy(Class->spcur))
+    {
         UserDereferenceObject(Class->spcur);
+        Class->spcur = NULL;
+    }
     if (Class->spicnSm)
     {
         UserDereferenceObject(Class->spicnSm);
diff --git a/reactos/win32ss/user/ntuser/cursoricon.c b/reactos/win32ss/user/ntuser/cursoricon.c
index 8dd98f1d6a4..fc91c37a2a8 100644
--- a/reactos/win32ss/user/ntuser/cursoricon.c
+++ b/reactos/win32ss/user/ntuser/cursoricon.c
@@ -1086,11 +1086,14 @@ NtUserSetCursor(
            goto leave;
         }
 
+        pcurOld->CURSORF_flags &= ~CURSORF_CURRENT;
+
         /* See if it was destroyed in the meantime */
         if (UserObjectInDestroy(hOldCursor))
-            hOldCursor = NULL;
-        pcurOld->CURSORF_flags &= ~CURSORF_CURRENT;
-        UserDereferenceObject(pcurOld);
+        {
+            UserDereferenceObject(pcurOld);
+            pcurOld = NULL;
+        }
     }
 
 leave:
diff --git a/reactos/win32ss/user/ntuser/msgqueue.c b/reactos/win32ss/user/ntuser/msgqueue.c
index 24a5d1973d4..59c8dc24f21 100644
--- a/reactos/win32ss/user/ntuser/msgqueue.c
+++ b/reactos/win32ss/user/ntuser/msgqueue.c
@@ -2288,8 +2288,12 @@ MsqCleanupMessageQueue(PTHREADINFO pti)
            IntGetSysCursorInfo()->CurrentCursorObject = NULL;
        }
 
-       TRACE("DereferenceObject pCursor\n");
-       UserDereferenceObject(pCursor);
+       if (pCursor && UserObjectInDestroy(UserHMGetHandle(pCursor)))
+       {
+           TRACE("DereferenceObject pCursor\n");
+           UserDereferenceObject(pCursor);
+           pCursor = NULL;
+       }
    }
 
    if (gpqForeground == MessageQueue)