user32: Protect from setting as a window owner one of window's succesors.

[Dmitry Timoshkov]

This patch applies the same logic used in set_parent() to set_window_owner(),
and fixes the problem reported in the bug 23707.
---
 dlls/user32/tests/win.c |    4 ++++
 server/window.c         |   16 +++++++++++++++-
 2 files changed, 19 insertions(+), 1 deletions(-)

diff --git a/dlls/user32/tests/win.c b/dlls/user32/tests/win.c
index 632e382..13df1c0 100644
--- a/dlls/user32/tests/win.c
+++ b/dlls/user32/tests/win.c
@@ -380,6 +380,10 @@ static void test_parent_owner(void)
     check_parents( test, desktop, 0, desktop, 0, test, desktop );
 
     /* window is now child of desktop so GWLP_HWNDPARENT changes owner from now on */
+    ret = (HWND)SetWindowLongPtrA( test, GWLP_HWNDPARENT, (LONG_PTR)test );
+    ok( ret == 0, "GWL_HWNDPARENT return value %p expected 0\n", ret );
+    check_parents( test, desktop, 0, desktop, 0, test, desktop );
+
     ret = (HWND)SetWindowLongPtrA( test, GWLP_HWNDPARENT, (LONG_PTR)child );
     ok( ret == 0, "GWL_HWNDPARENT return value %p expected 0\n", ret );
     check_parents( test, desktop, child, desktop, child, test, desktop );
diff --git a/server/window.c b/server/window.c
index 3b912b0..93c8893 100644
--- a/server/window.c
+++ b/server/window.c
@@ -1834,7 +1834,7 @@ DECL_HANDLER(get_desktop_window)
 DECL_HANDLER(set_window_owner)
 {
     struct window *win = get_window( req->handle );
-    struct window *owner = NULL;
+    struct window *owner = NULL, *ptr;
 
     if (!win) return;
     if (req->owner && !(owner = get_window( req->owner ))) return;
@@ -1843,6 +1843,20 @@ DECL_HANDLER(set_window_owner)
         set_error( STATUS_ACCESS_DENIED );
         return;
     }
+
+    /* make sure owner is not a succesor of window */
+    ptr = owner;
+    while (ptr)
+    {
+        if (ptr == win)
+        {
+            set_error( STATUS_INVALID_PARAMETER );
+            return;
+        }
+        ptr = ptr->owner ? get_window( ptr->owner ) : NULL;
+    }
+
+
     reply->prev_owner = win->owner;
     reply->full_owner = win->owner = owner ? owner->handle : 0;
 }
-- 
1.7.0.6