From: Thomas Faber <thomas.faber@reactos.org>
Date: Sat, 24 Oct 2015 15:04:12 +0000 (+0000)
Subject: [WIN32K:NTUSER]
X-Git-Tag: ReactOS-0.4.0~378
X-Git-Url: https://git.reactos.org/?p=reactos.git;a=commitdiff_plain;h=929dbdcd82b4e4007df1d6ac1d16d49624b155cc

[WIN32K:NTUSER]
- In UserAttachThreadInput, copy the CaretInfo structure instead of saving a pointer that may be freed right after
CORE-10395 #resolve

svn path=/trunk/; revision=69677
---

diff --git a/reactos/win32ss/user/ntuser/input.c b/reactos/win32ss/user/ntuser/input.c
index 62ab66ec21b..22ac414b110 100644
--- a/reactos/win32ss/user/ntuser/input.c
+++ b/reactos/win32ss/user/ntuser/input.c
@@ -524,7 +524,9 @@ UserAttachThreadInput(PTHREADINFO ptiFrom, PTHREADINFO ptiTo, BOOL fAttach)
               ptiTo->MessageQueue->spwndFocus   = ptiFrom->MessageQueue->spwndFocus;
               ptiTo->MessageQueue->spwndCapture = ptiFrom->MessageQueue->spwndCapture;
               ptiTo->MessageQueue->QF_flags    ^= ((ptiTo->MessageQueue->QF_flags ^ ptiFrom->MessageQueue->QF_flags) & QF_CAPTURELOCKED);
-              ptiTo->MessageQueue->CaretInfo    = ptiFrom->MessageQueue->CaretInfo;
+              RtlCopyMemory(ptiTo->MessageQueue->CaretInfo,
+                            ptiFrom->MessageQueue->CaretInfo,
+                            sizeof(ptiTo->MessageQueue->CaretInfo));
               IntSetFocusMessageQueue(NULL);
               IntSetFocusMessageQueue(ptiTo->MessageQueue);
               gptiForeground = ptiTo;