From bd027c9de4dca4ef53f9d8f3233749de3d25a4f2 Mon Sep 17 00:00:00 2001 From: Doug Lyons Date: Mon, 3 Oct 2022 17:26:02 -0500 Subject: [PATCH] [NTUSER] Fix 'Trying to link windows to itself' (#4478) CORE-18132 Fix 'Trying to link windows to itself' on DestroyWindow. Patch by I_Kill_Bugs. This fixes a potential BSOD 0x50 observable in the app Localizer Editor" --- win32ss/user/ntuser/winpos.c | 30 ++++++++++++++++++++++++++++-- 1 file changed, 28 insertions(+), 2 deletions(-) diff --git a/win32ss/user/ntuser/winpos.c b/win32ss/user/ntuser/winpos.c index 7795f0293b6..25c13b48102 100644 --- a/win32ss/user/ntuser/winpos.c +++ b/win32ss/user/ntuser/winpos.c @@ -1393,8 +1393,34 @@ WinPosDoOwnedPopups(PWND Window, HWND hWndInsertAfter) if (List[i] == Owner) { - if (i > 0) hWndInsertAfter = List[i-1]; - else hWndInsertAfter = topmost ? HWND_TOPMOST : HWND_TOP; + /* We found its Owner, so we must handle it here. */ + if (i > 0) + { + if (List[i - 1] != UserHMGetHandle(Window)) + { + /* + * If the popup to be inserted is not already just + * before the Owner, insert it there. The modified + * hWndInsertAfter will be handled below. + * + * (NOTE: Do not allow hWndInsertAfter to become equal + * to the popup's window handle, as this would cause + * the popup to link to itself). + */ + hWndInsertAfter = List[i - 1]; + } + else + { + /* If the popup to be inserted is already + * before the Owner, we are done. */ + ExFreePoolWithTag(List, USERTAG_WINDOWLIST); + return hWndInsertAfter; + } + } + else + { + hWndInsertAfter = topmost ? HWND_TOPMOST : HWND_TOP; + } break; } -- 2.17.1