[NTUSER] co_UserDestroyWindow: Validate window before destroying it (#5054)

Prevent the window from being destroyed twice
fixes BSOD 0x1E CORE-18821

diff --git a/win32ss/user/ntuser/window.c b/win32ss/user/ntuser/window.c
index f8bc4e5..7bc5786 100644 (file)
--- a/win32ss/user/ntuser/window.c
+++ b/win32ss/user/ntuser/window.c
@@ -2845,6 +2845,15 @@ BOOLEAN co_UserDestroyWindow(PVOID Object)
 
    ASSERT_REFS_CO(Window); // FIXME: Temp HACK?
 
+   /* NtUserDestroyWindow does check if the window has already been destroyed
+      but co_UserDestroyWindow can be called from more paths which means
+      that it can also be called for a window that has already been destroyed. */
+   if (!IntIsWindow(UserHMGetHandle(Window)))
+   {
+      TRACE("Tried to destroy a window twice\n");
+      return TRUE;
+   }
+
    hWnd = Window->head.h;
    ti = PsGetCurrentThreadWin32Thread();