diff --git a/win32ss/user/ntuser/window.c b/win32ss/user/ntuser/window.c
index b6a2c28bab2..ec20353f12f 100644
--- a/win32ss/user/ntuser/window.c
+++ b/win32ss/user/ntuser/window.c
@@ -104,7 +104,7 @@ PWND FASTCALL VerifyWnd(PWND pWnd)
       EngSetLastError(Error);
       _SEH2_YIELD(return NULL);
    }
-   _SEH2_END
+   _SEH2_END;
 
    if ( UserObjectInDestroy(hWnd) ||
         State & WNDS_DESTROYED ||
@@ -1572,7 +1572,7 @@ NtUserBuildHwndList(
                   {
                      Status = _SEH2_GetExceptionCode();
                   }
-                  _SEH2_END
+                  _SEH2_END;
                   if(!NT_SUCCESS(Status))
                   {
                      break;
@@ -1650,7 +1650,7 @@ NtUserBuildHwndList(
                   {
                      Status = _SEH2_GetExceptionCode();
                   }
-                  _SEH2_END
+                  _SEH2_END;
                   if (!NT_SUCCESS(Status))
                   {
                      ERR("Failure to build window list!\n");
@@ -2600,7 +2600,7 @@ ProbeAndCaptureLargeString(
         /* Fail */
         _SEH2_YIELD(return _SEH2_GetExceptionCode();)
     }
-    _SEH2_END
+    _SEH2_END;
 
     if (lstrTemp.Length != 0)
     {
@@ -2623,7 +2623,7 @@ ProbeAndCaptureLargeString(
             ExFreePoolWithTag(pvBuffer, TAG_STRING);
             _SEH2_YIELD(return _SEH2_GetExceptionCode();)
         }
-        _SEH2_END
+        _SEH2_END;
     }
 
     /* Set the output string */
@@ -2876,6 +2876,19 @@ BOOLEAN co_UserDestroyWindow(PVOID Object)
          if (Window->spwndOwner)
          {
             //ERR("DestroyWindow Owner out.\n");
+            _SEH2_TRY
+            {
+               ProbeForRead(Window->spwndOwner->head.h, sizeof(PWND), 1);
+            }
+            _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
+            {
+               /* Cleanup and fail */
+               TRACE("Trying to Improperly Access Freed Memory\n");
+               EngSetLastError(_SEH2_GetExceptionCode());
+               _SEH2_YIELD(return FALSE;)
+            }
+            _SEH2_END;
+
             UserAttachThreadInput(Window->head.pti, Window->spwndOwner->head.pti, FALSE);
          }
       }