From 915201e11252f1ec0eafaad8c6d38b3780667be1 Mon Sep 17 00:00:00 2001
From: Dmitry Gorbachev <gorbachev@reactos.org>
Date: Fri, 11 May 2007 14:12:21 +0000
Subject: [PATCH] Fix (partially) bug #2243.

svn path=/trunk/; revision=26698
---
 reactos/ntoskrnl/lpc/send.c | 25 ++++++++++++++++++++-----
 1 file changed, 20 insertions(+), 5 deletions(-)

diff --git a/reactos/ntoskrnl/lpc/send.c b/reactos/ntoskrnl/lpc/send.c
index 952f4ae9595..7c3cbd72d3f 100644
--- a/reactos/ntoskrnl/lpc/send.c
+++ b/reactos/ntoskrnl/lpc/send.c
@@ -285,11 +285,26 @@ NtRequestWaitReplyPort(IN HANDLE PortHandle,
     else
     {
         /* No callback, just copy the message */
-        LpcpMoveMessage(&Message->Request,
-                        LpcRequest,
-                        LpcRequest + 1,
-                        MessageType,
-                        &Thread->Cid);
+        _SEH_TRY
+        {
+            LpcpMoveMessage(&Message->Request,
+                            LpcRequest,
+                            LpcRequest + 1,
+                            MessageType,
+                            &Thread->Cid);
+        }
+        _SEH_HANDLE
+        {
+            Status = _SEH_GetExceptionCode();
+        }
+        _SEH_END;
+
+        if (!NT_SUCCESS(Status))
+        {
+            LpcpFreeToPortZone(Message, 0);
+            ObDereferenceObject(Port);
+            return Status;
+        }
 
         /* Acquire the LPC lock */
         KeAcquireGuardedMutex(&LpcpLock);