From 0d1b3f323540d29ec270ea7eb94c42b485261bd1 Mon Sep 17 00:00:00 2001
From: Thamatip Chitpong <thamatip.chitpong@reactos.org>
Date: Thu, 7 Dec 2023 14:02:38 +0700
Subject: [PATCH] [NTUSER] MENU_HideSubPopups: Check ValidateHwndNoErr return
 value

Check if the return value is not NULL before calling co_UserDestroyWindow.
CORE-19367
---
 win32ss/user/ntuser/menu.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/win32ss/user/ntuser/menu.c b/win32ss/user/ntuser/menu.c
index b02eb7b88cfe0..8f117ea9f49a0 100644
--- a/win32ss/user/ntuser/menu.c
+++ b/win32ss/user/ntuser/menu.c
@@ -3282,11 +3282,13 @@ static void FASTCALL MENU_HideSubPopups(PWND pWndOwner, PMENU Menu,
       {
           PWND pWnd;
           if (!VerifyMenu(Item->spSubMenu)) return;
-          pWnd = ValidateHwndNoErr(Item->spSubMenu->hWnd);
           MENU_HideSubPopups(pWndOwner, Item->spSubMenu, FALSE, wFlags);
           MENU_SelectItem(pWndOwner, Item->spSubMenu, NO_SELECTED_ITEM, SendMenuSelect, NULL);
           TRACE("M_HSP top p hm %p  pWndOwner IDMenu %p\n",top_popup_hmenu,pWndOwner->IDMenu);
-          co_UserDestroyWindow(pWnd);
+
+          pWnd = ValidateHwndNoErr(Item->spSubMenu->hWnd);
+          if (pWnd)
+             co_UserDestroyWindow(pWnd);
 
           /* Native returns handle to destroyed window */
           if (!(wFlags & TPM_NONOTIFY))