[WIN32K:NTUSER]
authorThomas Faber <thomas.faber@reactos.org>
Sat, 24 Oct 2015 15:04:12 +0000 (15:04 +0000)
committerThomas Faber <thomas.faber@reactos.org>
Sat, 24 Oct 2015 15:04:12 +0000 (15:04 +0000)
- In UserAttachThreadInput, copy the CaretInfo structure instead of saving a pointer that may be freed right after
CORE-10395 #resolve

svn path=/trunk/; revision=69677

reactos/win32ss/user/ntuser/input.c

index 62ab66e..22ac414 100644 (file)
@@ -524,7 +524,9 @@ UserAttachThreadInput(PTHREADINFO ptiFrom, PTHREADINFO ptiTo, BOOL fAttach)
               ptiTo->MessageQueue->spwndFocus   = ptiFrom->MessageQueue->spwndFocus;
               ptiTo->MessageQueue->spwndCapture = ptiFrom->MessageQueue->spwndCapture;
               ptiTo->MessageQueue->QF_flags    ^= ((ptiTo->MessageQueue->QF_flags ^ ptiFrom->MessageQueue->QF_flags) & QF_CAPTURELOCKED);
-              ptiTo->MessageQueue->CaretInfo    = ptiFrom->MessageQueue->CaretInfo;
+              RtlCopyMemory(ptiTo->MessageQueue->CaretInfo,
+                            ptiFrom->MessageQueue->CaretInfo,
+                            sizeof(ptiTo->MessageQueue->CaretInfo));
               IntSetFocusMessageQueue(NULL);
               IntSetFocusMessageQueue(ptiTo->MessageQueue);
               gptiForeground = ptiTo;