mirror of
https://github.com/reactos/reactos.git
synced 2024-06-29 01:12:06 +00:00
[WIN32K:USER] Fix potential use after free when painting child windows
This commit is contained in:
parent
d958dc9bc2
commit
b783b16cef
|
@ -369,14 +369,26 @@ IntSendNCPaint(PWND pWnd, HRGN hRgn)
|
|||
VOID FASTCALL
|
||||
IntSendChildNCPaint(PWND pWnd)
|
||||
{
|
||||
for (pWnd = pWnd->spwndChild; pWnd; pWnd = pWnd->spwndNext)
|
||||
pWnd = pWnd->spwndChild;
|
||||
while (pWnd)
|
||||
{
|
||||
if ((pWnd->hrgnUpdate == NULL) && (pWnd->state & WNDS_SENDNCPAINT))
|
||||
{
|
||||
PWND Next;
|
||||
USER_REFERENCE_ENTRY Ref;
|
||||
|
||||
/* Reference, IntSendNCPaint leaves win32k */
|
||||
UserRefObjectCo(pWnd, &Ref);
|
||||
IntSendNCPaint(pWnd, HRGN_WINDOW);
|
||||
|
||||
/* Make sure to grab next one before dereferencing/freeing */
|
||||
Next = pWnd->spwndNext;
|
||||
UserDerefObjectCo(pWnd);
|
||||
pWnd = Next;
|
||||
}
|
||||
else
|
||||
{
|
||||
pWnd = pWnd->spwndNext;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
|
Loading…
Reference in a new issue