From 55b92475f2d8bacf1b476d06fe97120fca4bff78 Mon Sep 17 00:00:00 2001
From: Richard Cohen <richard@jubjub.demon.co.uk>
Date: Sun, 19 Sep 1999 14:05:05 +0000
Subject: [PATCH] Protect MDISetMenu from rogue menu handles.

---
 windows/mdi.c | 15 ++++++++++++++-
 1 file changed, 14 insertions(+), 1 deletion(-)

diff --git a/windows/mdi.c b/windows/mdi.c
index 3547b44f6e6..c441f909326 100644
--- a/windows/mdi.c
+++ b/windows/mdi.c
@@ -207,7 +207,7 @@ static void MDI_CalcDefaultChildPos( WND* w, WORD n, LPPOINT lpPos,
 static LRESULT MDISetMenu( HWND hwnd, HMENU hmenuFrame,
                            HMENU hmenuWindow)
 {
-    WND *w = WIN_FindWndPtr(hwnd);
+    WND *w;
     MDICLIENTINFO *ci;
     HWND hwndFrame = GetParent(hwnd);
     HMENU oldFrameMenu = GetMenu(hwndFrame);
@@ -215,6 +215,19 @@ static LRESULT MDISetMenu( HWND hwnd, HMENU hmenuFrame,
     TRACE("%04x %04x %04x\n",
                 hwnd, hmenuFrame, hmenuWindow);
 
+    if (hmenuFrame && !IsMenu(hmenuFrame))
+    {
+	WARN("hmenuFrame is not a menu handle\n");
+	return 0L;
+    }
+	
+    if (hmenuWindow && !IsMenu(hmenuWindow))
+    {
+	WARN("hmenuWindow is not a menu handle\n");
+	return 0L;
+    }
+	
+    w = WIN_FindWndPtr(hwnd);
     ci = (MDICLIENTINFO *) w->wExtra;
 
     if( ci->hwndChildMaximized && hmenuFrame && hmenuFrame!=oldFrameMenu )