From 81c0fbc19f19b7be9aad1f830664a848c237dbd0 Mon Sep 17 00:00:00 2001
From: Aleksey Bragin <aleksey@reactos.org>
Date: Tue, 15 Jul 2008 14:00:37 +0000
Subject: [PATCH] Yuriy Sidorov <jura@cp-lab.com> - Fix BSOD in
 NtUserWaitForInputIdle because KeWaitForMultipleObjects expects actual
 pointers to objects, not handles. - Fix failure branches to have UserLeave
 and/or object dereference where needed. See issue #3522 for more details.

svn path=/trunk/; revision=34525
---
 reactos/subsystems/win32/win32k/ntuser/message.c | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/reactos/subsystems/win32/win32k/ntuser/message.c b/reactos/subsystems/win32/win32k/ntuser/message.c
index 251af96489b..e3a85306078 100644
--- a/reactos/subsystems/win32/win32k/ntuser/message.c
+++ b/reactos/subsystems/win32/win32k/ntuser/message.c
@@ -1898,6 +1898,7 @@ NtUserWaitForInputIdle(
 
   if (!NT_SUCCESS(Status))
   {
+     UserLeave();
      SetLastNtError(Status);
      return WAIT_FAILED;
   }
@@ -1906,16 +1907,22 @@ NtUserWaitForInputIdle(
   if (!W32Process)
   {
       ObDereferenceObject(Process);
+      UserLeave();
       SetLastWin32Error(ERROR_INVALID_PARAMETER);
       return WAIT_FAILED;
   }
 
   EngCreateEvent((PEVENT *)&W32Process->InputIdleEvent);
 
-  Handles[0] = hProcess;
+  Handles[0] = Process;
   Handles[1] = W32Process->InputIdleEvent;
 
-  if (!Handles[1]) return STATUS_SUCCESS;  /* no event to wait on */
+  if (!Handles[1])
+  {
+      ObDereferenceObject(Process);
+      UserLeave();
+      return STATUS_SUCCESS;  /* no event to wait on */
+  }
 
   StartTime = ((ULONGLONG)SharedUserData->TickCountLowDeprecated *
                           SharedUserData->TickCountMultiplier / 16777216);