From 3a61fab955404037923329ac7981cf0ef5dca25b Mon Sep 17 00:00:00 2001
From: Timo Kreuzer <timo.kreuzer@reactos.org>
Date: Sun, 27 Feb 2011 15:16:00 +0000
Subject: [PATCH] [NTOSKRNL] Fix a serious bug, where NtAllocateVirtualMemory
 could allocate memory user mode memory above MmHighestUserAddress up to
 MmSystemRangeStart - 1, which is a no-access area.

svn path=/trunk/; revision=50917
---
 reactos/ntoskrnl/mm/marea.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/reactos/ntoskrnl/mm/marea.c b/reactos/ntoskrnl/mm/marea.c
index cacf2ae667e..dc50d13f723 100644
--- a/reactos/ntoskrnl/mm/marea.c
+++ b/reactos/ntoskrnl/mm/marea.c
@@ -458,7 +458,7 @@ MmFindGapBottomUp(
 {
    PVOID LowestAddress  = MmGetAddressSpaceOwner(AddressSpace) ? MM_LOWEST_USER_ADDRESS : MmSystemRangeStart;
    PVOID HighestAddress = MmGetAddressSpaceOwner(AddressSpace) ?
-                          (PVOID)((ULONG_PTR)MmSystemRangeStart - 1) : (PVOID)MAXULONG_PTR;
+                            MmHighestUserAddress : (PVOID)MAXULONG_PTR;
    PVOID AlignedAddress;
    PMEMORY_AREA Node;
    PMEMORY_AREA FirstNode;