From f0e276168dca501186dddcc2ab3d0e0cfdbbd502 Mon Sep 17 00:00:00 2001
From: =?utf8?q?J=C3=A9r=C3=B4me=20Gardou?= <jerome.gardou@reactos.org>
Date: Thu, 23 Oct 2014 09:52:57 +0000
Subject: [PATCH] [WIN32K]  - Call IntDestroyCurIconObject instead of
 explicitly destroying the handle. CORE-7575

svn path=/trunk/; revision=64915
---
 reactos/win32ss/user/ntuser/cursoricon_new.c | 28 +++++++++-----------
 1 file changed, 13 insertions(+), 15 deletions(-)

diff --git a/reactos/win32ss/user/ntuser/cursoricon_new.c b/reactos/win32ss/user/ntuser/cursoricon_new.c
index 59334703b38..2fbfe99fb60 100644
--- a/reactos/win32ss/user/ntuser/cursoricon_new.c
+++ b/reactos/win32ss/user/ntuser/cursoricon_new.c
@@ -644,40 +644,36 @@ NtUserDestroyCursor(
   _In_   BOOL bForce)
 {
     BOOL ret;
+    PCURICON_OBJECT CurIcon = NULL;
 
     TRACE("Enter NtUserDestroyCursorIcon (%p, %u)\n", hCurIcon, bForce);
     UserEnterExclusive();
 
+    CurIcon = UserGetCurIconObject(hCurIcon);
+    if (!CurIcon)
+    {
+        ret = FALSE;
+        goto leave;
+    }
+
     if (!bForce)
     {
         /* Maybe we have good reasons not to destroy this object */
-        PCURICON_OBJECT CurIcon = UserGetCurIconObject(hCurIcon);
-        ULONG Flags;
-        if (!CurIcon)
-        {
-            ret = FALSE;
-            goto leave;
-        }
-
         if (CurIcon->head.ppi != PsGetCurrentProcessWin32Process())
         {
             /* No way, you're not touching my cursor */
             ret = FALSE;
-            UserDereferenceObject(CurIcon);
             goto leave;
         }
 
-        Flags = CurIcon->CURSORF_flags;
-        UserDereferenceObject(CurIcon);
-
-        if (Flags & CURSORF_CURRENT)
+        if (CurIcon->CURSORF_flags & CURSORF_CURRENT)
         {
             WARN("Trying to delete current cursor!\n");
             ret = FALSE;
             goto leave;
         }
 
-        if (Flags & CURSORF_LRSHARED)
+        if (CurIcon->CURSORF_flags & CURSORF_LRSHARED)
         {
             WARN("Trying to delete shared cursor.\n");
             /* This one is not an error */
@@ -687,9 +683,11 @@ NtUserDestroyCursor(
     }
 
     /* Destroy the handle */
-    ret = UserDeleteObject(hCurIcon, TYPE_CURSOR);
+    ret = IntDestroyCurIconObject(CurIcon);
 
 leave:
+    if (CurIcon)
+        UserDereferenceObject(CurIcon);
     TRACE("Leave NtUserDestroyCursorIcon, ret=%i\n", ret);
     UserLeave();
     return ret;
-- 
2.17.1