From e04361b3a8196b99f1b619cda709d140be15194d Mon Sep 17 00:00:00 2001
From: Timo Kreuzer <timo.kreuzer@reactos.org>
Date: Tue, 10 Mar 2015 00:09:41 +0000
Subject: [PATCH] [WIN32K] Fix bug in EngMapEvent

svn path=/trunk/; revision=66638
---
 reactos/win32ss/gdi/eng/engevent.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/reactos/win32ss/gdi/eng/engevent.c b/reactos/win32ss/gdi/eng/engevent.c
index 77b00a4006f..edc4620271b 100644
--- a/reactos/win32ss/gdi/eng/engevent.c
+++ b/reactos/win32ss/gdi/eng/engevent.c
@@ -119,6 +119,7 @@ EngMapEvent(
     _Reserved_ PVOID Reserved3)
 {
     PENG_EVENT EngEvent;
+    PVOID pvEvent;
     NTSTATUS Status;
 
     /* Allocate memory for the event structure */
@@ -132,16 +133,17 @@ EngMapEvent(
     EngEvent->pKEvent = NULL;
 
     /* Create a handle, and have Ob fill out the pKEvent field */
-    Status = ObReferenceObjectByHandle(EngEvent,
+    Status = ObReferenceObjectByHandle(hUserObject,
                                        EVENT_ALL_ACCESS,
                                        *ExEventObjectType,
                                        UserMode,
-                                       &EngEvent->pKEvent,
+                                       &pvEvent,
                                        NULL);
     if (NT_SUCCESS(Status))
     {
         /* Pulse the event and set that it's mapped by user */
-        KePulseEvent(EngEvent->pKEvent, EVENT_INCREMENT, FALSE);
+        KePulseEvent(pvEvent, EVENT_INCREMENT, FALSE);
+        EngEvent->pKEvent = pvEvent;
         EngEvent->fFlags |= ENG_EVENT_USERMAPPED;
     }
     else