Fix ref counting bug

svn path=/trunk/; revision=12749

diff --git a/reactos/subsys/win32k/ntuser/cursoricon.c b/reactos/subsys/win32k/ntuser/cursoricon.c
index b456b72..40a27a6 100644 (file)
--- a/reactos/subsys/win32k/ntuser/cursoricon.c
+++ b/reactos/subsys/win32k/ntuser/cursoricon.c
@@ -343,21 +343,25 @@ IntFindExistingCurIconObject(PWINSTATION_OBJECT WinStaObject, HMODULE hModule,
   {
     Object = CONTAINING_RECORD(CurrentEntry, CURICON_OBJECT, ListEntry);
     CurrentEntry = CurrentEntry->Flink;
-    if((Object->hModule == hModule) && (Object->hRsrc == hRsrc))
+    if(NT_SUCCESS(ObmReferenceObjectByPointer(Object, otCursorIcon)))
     {
-      if(cx && ((cx != Object->Size.cx) || (cy != Object->Size.cy)))
-      {
-        ObmDereferenceObject(Object);
-       continue;
-      }
-      if (! ReferenceCurIconByProcess(Object))
+      if((Object->hModule == hModule) && (Object->hRsrc == hRsrc))
       {
+        if(cx && ((cx != Object->Size.cx) || (cy != Object->Size.cy)))
+        {
+          ObmDereferenceObject(Object);
+          continue;
+        }
+        if (! ReferenceCurIconByProcess(Object))
+        {
+          ExReleaseFastMutex(&CurIconListLock);
+          return NULL;
+        }
         ExReleaseFastMutex(&CurIconListLock);
-        return NULL;
+        return Object;
       }
-      ExReleaseFastMutex(&CurIconListLock);
-      return Object;
     }
+    ObmDereferenceObject(Object);
   }
   
   ExReleaseFastMutex(&CurIconListLock);