From 929dbdcd82b4e4007df1d6ac1d16d49624b155cc Mon Sep 17 00:00:00 2001
From: Thomas Faber <thomas.faber@reactos.org>
Date: Sat, 24 Oct 2015 15:04:12 +0000
Subject: [PATCH] [WIN32K:NTUSER] - In UserAttachThreadInput, copy the
 CaretInfo structure instead of saving a pointer that may be freed right after
 CORE-10395 #resolve

svn path=/trunk/; revision=69677
---
 reactos/win32ss/user/ntuser/input.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/reactos/win32ss/user/ntuser/input.c b/reactos/win32ss/user/ntuser/input.c
index 62ab66ec21b..22ac414b110 100644
--- a/reactos/win32ss/user/ntuser/input.c
+++ b/reactos/win32ss/user/ntuser/input.c
@@ -524,7 +524,9 @@ UserAttachThreadInput(PTHREADINFO ptiFrom, PTHREADINFO ptiTo, BOOL fAttach)
               ptiTo->MessageQueue->spwndFocus   = ptiFrom->MessageQueue->spwndFocus;
               ptiTo->MessageQueue->spwndCapture = ptiFrom->MessageQueue->spwndCapture;
               ptiTo->MessageQueue->QF_flags    ^= ((ptiTo->MessageQueue->QF_flags ^ ptiFrom->MessageQueue->QF_flags) & QF_CAPTURELOCKED);
-              ptiTo->MessageQueue->CaretInfo    = ptiFrom->MessageQueue->CaretInfo;
+              RtlCopyMemory(ptiTo->MessageQueue->CaretInfo,
+                            ptiFrom->MessageQueue->CaretInfo,
+                            sizeof(ptiTo->MessageQueue->CaretInfo));
               IntSetFocusMessageQueue(NULL);
               IntSetFocusMessageQueue(ptiTo->MessageQueue);
               gptiForeground = ptiTo;