diff --git a/win32ss/user/ntuser/winpos.c b/win32ss/user/ntuser/winpos.c index 27f594e554c..7932dcf49b2 100644 --- a/win32ss/user/ntuser/winpos.c +++ b/win32ss/user/ntuser/winpos.c @@ -1393,8 +1393,26 @@ WinPosDoOwnedPopups(PWND Window, HWND hWndInsertAfter) if (List[i] == Owner) { - if (i > 0) hWndInsertAfter = List[i-1]; - else hWndInsertAfter = topmost ? HWND_TOPMOST : HWND_TOP; + /* We found its Owner, so we must handle it here. */ + if (i > 0) + { + if (List[i-1] != Window->head.h) + { + /* Do not allow hWndInsertAfter to become equal to + * Window->head.h. This would cause the window to + * reference itself. */ + hWndInsertAfter = List[i-1]; + } + else + { + /* If hWndInsertAfter is equal to Window->head.h */ + return hWndInsertAfter; + } + } + else + { + hWndInsertAfter = topmost ? HWND_TOPMOST : HWND_TOP; + } break; }