From e8e770fd14bc2e3623bb78874876a8285fbc5aec Mon Sep 17 00:00:00 2001 From: Timo Kreuzer Date: Fri, 3 May 2024 15:39:33 +0300 Subject: [PATCH] [WIN32K:NTUSER] Fix NULL pointer dereference in MENU_HideSubPopups Fixes CORE-19367. --- win32ss/user/ntuser/menu.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/win32ss/user/ntuser/menu.c b/win32ss/user/ntuser/menu.c index a9aace74837..fe68f82e407 100644 --- a/win32ss/user/ntuser/menu.c +++ b/win32ss/user/ntuser/menu.c @@ -3282,11 +3282,14 @@ static void FASTCALL MENU_HideSubPopups(PWND pWndOwner, PMENU Menu, { PWND pWnd; if (!VerifyMenu(Item->spSubMenu)) return; - pWnd = ValidateHwndNoErr(Item->spSubMenu->hWnd); MENU_HideSubPopups(pWndOwner, Item->spSubMenu, FALSE, wFlags); MENU_SelectItem(pWndOwner, Item->spSubMenu, NO_SELECTED_ITEM, SendMenuSelect, NULL); TRACE("M_HSP top p hm %p pWndOwner IDMenu %p\n",top_popup_hmenu,pWndOwner->IDMenu); - co_UserDestroyWindow(pWnd); + pWnd = ValidateHwndNoErr(Item->spSubMenu->hWnd); + if (pWnd != NULL) + { + co_UserDestroyWindow(pWnd); + } /* Native returns handle to destroyed window */ if (!(wFlags & TPM_NONOTIFY))