[NTUSER] IntTrackPopupMenuEx: Check TPMPARAMS.cbSize (reactos#8092)

Validate structure size.
JIRA issue: CORE-3247
- In IntTrackPopupMenuEx function,
  if lpTpm was non-NULL, then
  validate lpTpm->cbSize.
- If validation failed, then set last
  error and return FALSE.

Author: katahiromz

win32ss/user/ntuser/menu.c

@@ -4580,6 +4580,13 @@ BOOL WINAPI IntTrackPopupMenuEx( PMENU menu, UINT wFlags, int x, int y,
     BOOL ret = FALSE;
     PTHREADINFO pti = PsGetCurrentThreadWin32Thread();
 
+    if (lpTpm && lpTpm->cbSize != sizeof(*lpTpm))
+    {
+        ERR("Invalid TPMPARAMS size: got %u, expected %zu\n", lpTpm->cbSize, sizeof(*lpTpm));
+        EngSetLastError(ERROR_INVALID_PARAMETER);
+        return FALSE;
+    }
+
     if (pti != pWnd->head.pti)
     {
        ERR("Must be the same pti!\n");