From 018264f38f5088cae07e514317f89dc0df30e242 Mon Sep 17 00:00:00 2001
From: Thamatip Chitpong <thamatip.chitpong@reactos.org>
Date: Fri, 26 Apr 2024 07:12:02 +0700
Subject: [PATCH] [NTUSER] Release modifier keys when deactivating message
 queue (#6754)

CORE-14768
---
 win32ss/user/ntuser/focus.c    |  3 +++
 win32ss/user/ntuser/msgqueue.c | 15 +++++++++++++++
 win32ss/user/ntuser/msgqueue.h |  3 +++
 3 files changed, 21 insertions(+)

diff --git a/win32ss/user/ntuser/focus.c b/win32ss/user/ntuser/focus.c
index d641e163e0d..ef566232dc3 100644
--- a/win32ss/user/ntuser/focus.c
+++ b/win32ss/user/ntuser/focus.c
@@ -341,6 +341,9 @@ IntDeactivateWindow(PTHREADINFO pti, HANDLE tid)
       UserDerefObjectCo(pwndFocus);
    }
 
+   /* Check for keyboard modifiers and release them (CORE-14768) */
+   MsqReleaseModifierKeys(pti->MessageQueue);
+
    if (InAAPM) pti->TIF_flags &= ~TIF_INACTIVATEAPPMSG;
    if (ptiCurrent != pti)
    {
diff --git a/win32ss/user/ntuser/msgqueue.c b/win32ss/user/ntuser/msgqueue.c
index b704dbce5ca..1624cbfaddd 100644
--- a/win32ss/user/ntuser/msgqueue.c
+++ b/win32ss/user/ntuser/msgqueue.c
@@ -2530,6 +2530,21 @@ MsqSetStateWindow(PTHREADINFO pti, ULONG Type, HWND hWnd)
    return NULL;
 }
 
+VOID FASTCALL
+MsqReleaseModifierKeys(PUSER_MESSAGE_QUEUE MessageQueue)
+{
+    WORD ModifierKeys[] = { VK_LCONTROL, VK_RCONTROL, VK_CONTROL,
+                            VK_LMENU,    VK_RMENU,    VK_MENU,
+                            VK_LSHIFT,   VK_RSHIFT,   VK_SHIFT };
+    UINT i;
+
+    for (i = 0; i < _countof(ModifierKeys); ++i)
+    {
+        if (IS_KEY_DOWN(MessageQueue->afKeyState, ModifierKeys[i]))
+            SET_KEY_DOWN(MessageQueue->afKeyState, ModifierKeys[i], FALSE);
+    }
+}
+
 SHORT
 APIENTRY
 NtUserGetKeyState(INT key)
diff --git a/win32ss/user/ntuser/msgqueue.h b/win32ss/user/ntuser/msgqueue.h
index d3e3399b416..57ea573177a 100644
--- a/win32ss/user/ntuser/msgqueue.h
+++ b/win32ss/user/ntuser/msgqueue.h
@@ -288,4 +288,7 @@ co_IntWaitMessage( PWND Window,
                    UINT MsgFilterMin,
                    UINT MsgFilterMax );
 
+VOID FASTCALL
+MsqReleaseModifierKeys(PUSER_MESSAGE_QUEUE MessageQueue);
+
 /* EOF */