From e3c8002dfc79e478a6d156c52abd4e243d36d754 Mon Sep 17 00:00:00 2001
From: Thomas Faber <thomas.faber@reactos.org>
Date: Fri, 28 Dec 2018 13:39:23 +0100
Subject: [PATCH] [WIN32K:NTUSER] Reference menus owned by a popup menu.
 CORE-15504

---
 win32ss/user/ntuser/menu.c | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/win32ss/user/ntuser/menu.c b/win32ss/user/ntuser/menu.c
index 6c825f3f107..0dc6bac3759 100644
--- a/win32ss/user/ntuser/menu.c
+++ b/win32ss/user/ntuser/menu.c
@@ -4512,6 +4512,10 @@ PopupMenuWndProc(
       {
         CREATESTRUCTW *cs = (CREATESTRUCTW *) lParam;
         pPopupMenu->spmenu = UserGetMenuObject(cs->lpCreateParams);
+        if (pPopupMenu->spmenu)
+        {
+           UserReferenceObject(pPopupMenu->spmenu);
+        }
         break;
       }
 
@@ -4556,6 +4560,10 @@ PopupMenuWndProc(
 
     case WM_NCDESTROY:
       {
+         if (pPopupMenu->spmenu)
+         {
+            IntReleaseMenuObject(pPopupMenu->spmenu);
+         }
          DesktopHeapFree(Wnd->head.rpdesk, pPopupMenu );
          ((PMENUWND)Wnd)->ppopupmenu = 0;
          Wnd->fnid = FNID_DESTROY;
@@ -4571,6 +4579,11 @@ PopupMenuWndProc(
            ERR("Bad Menu Handle\n");
            break;
         }
+        UserReferenceObject(pmenu);
+        if (pPopupMenu->spmenu)
+        {
+           IntReleaseMenuObject(pPopupMenu->spmenu);
+        }
         pPopupMenu->spmenu = pmenu;
         break;
       }