From da83a8919ec678b842efe507be7d143b28b7f17e Mon Sep 17 00:00:00 2001
From: James Tabor <james.tabor@reactos.org>
Date: Mon, 24 Oct 2011 14:49:25 +0000
Subject: [PATCH] [User32] - Fix class window procedure checks, prevents
 misbehaving applications from calling wrong class procs.

svn path=/trunk/; revision=54250
---
 reactos/dll/win32/user32/windows/menu.c | 20 ++++++++++++++++++--
 1 file changed, 18 insertions(+), 2 deletions(-)

diff --git a/reactos/dll/win32/user32/windows/menu.c b/reactos/dll/win32/user32/windows/menu.c
index a298073ba9d..d6727b779a9 100644
--- a/reactos/dll/win32/user32/windows/menu.c
+++ b/reactos/dll/win32/user32/windows/menu.c
@@ -1801,7 +1801,15 @@ LRESULT WINAPI PopupMenuWndProcA(HWND Wnd, UINT Message, WPARAM wParam, LPARAM l
      {
         NtUserSetWindowFNID(Wnd, FNID_MENU);
      }
-  }    
+     else
+     {
+        if (pWnd->fnid != FNID_MENU)
+        {
+           ERR("Wrong window class for Menu!\n");
+           return 0;
+        }
+     }
+  }
 #endif    
 
   TRACE("YES! hwnd=%x msg=0x%04x wp=0x%04lx lp=0x%08lx\n", Wnd, Message, wParam, lParam);
@@ -1890,7 +1898,15 @@ PopupMenuWndProcW(HWND Wnd, UINT Message, WPARAM wParam, LPARAM lParam)
      {
         NtUserSetWindowFNID(Wnd, FNID_MENU);
      }
-  }    
+     else
+     {
+        if (pWnd->fnid != FNID_MENU)
+        {
+           ERR("Wrong window class for Menu!\n");
+           return 0;
+        }
+     }
+  }
 #endif    
 
   TRACE("hwnd=%x msg=0x%04x wp=0x%04lx lp=0x%08lx\n", Wnd, Message, wParam, lParam);