From e95ca2d8b738d8f4062f42aae28525c3e220b3aa Mon Sep 17 00:00:00 2001
From: James Tabor <james.tabor@reactos.org>
Date: Thu, 30 Jun 2016 15:48:20 +0000
Subject: [PATCH] [NtUser] - Use internal function to validate menu handle. See
 CORE-11479 for more information.

svn path=/trunk/; revision=71704
---
 reactos/win32ss/user/ntuser/menu.c   | 9 +++++++++
 reactos/win32ss/user/ntuser/menu.h   | 2 ++
 reactos/win32ss/user/ntuser/window.h | 2 +-
 3 files changed, 12 insertions(+), 1 deletion(-)

diff --git a/reactos/win32ss/user/ntuser/menu.c b/reactos/win32ss/user/ntuser/menu.c
index b687b327549..2cb3f0738fa 100644
--- a/reactos/win32ss/user/ntuser/menu.c
+++ b/reactos/win32ss/user/ntuser/menu.c
@@ -242,6 +242,15 @@ PMENU FASTCALL VerifyMenu(PMENU pMenu)
    return pMenu;
 }
 
+BOOL
+FASTCALL
+IntIsMenu(HMENU Menu)
+{
+  if (UserGetMenuObject(Menu)) return TRUE;
+  return FALSE;
+}
+
+
 PMENU WINAPI
 IntGetMenu(HWND hWnd)
 {
diff --git a/reactos/win32ss/user/ntuser/menu.h b/reactos/win32ss/user/ntuser/menu.h
index 77eff6565c4..c9a990af59d 100644
--- a/reactos/win32ss/user/ntuser/menu.h
+++ b/reactos/win32ss/user/ntuser/menu.h
@@ -122,6 +122,8 @@ typedef struct tagROSMENUITEMINFO
 //
 //
 
+BOOL FASTCALL IntIsMenu(HMENU);
+
 PMENU FASTCALL
 IntGetMenuObject(HMENU hMenu);
 
diff --git a/reactos/win32ss/user/ntuser/window.h b/reactos/win32ss/user/ntuser/window.h
index d3772060273..79c5988d69a 100644
--- a/reactos/win32ss/user/ntuser/window.h
+++ b/reactos/win32ss/user/ntuser/window.h
@@ -16,7 +16,7 @@ extern ATOM AtomFlashWndState;
 #define HAS_THINFRAME(Style, ExStyle) \
             (((Style) & WS_BORDER) || (!((Style) & (WS_CHILD | WS_POPUP))))
 
-#define HAS_MENU(pWnd,style)  ((((style) & (WS_CHILD | WS_POPUP)) != WS_CHILD) && pWnd->IDMenu)
+#define HAS_MENU(pWnd,style)  ((((style) & (WS_CHILD | WS_POPUP)) != WS_CHILD) && IntIsMenu(UlongToHandle(pWnd->IDMenu)))
 
 #define IntIsDesktopWindow(WndObj) \
   (WndObj->spwndParent == NULL)
-- 
2.17.1