From 6b1af86bdea8ff65289145fe1597d68ae1e01a9b Mon Sep 17 00:00:00 2001 From: Roel Messiant Date: Sun, 6 Mar 2011 00:37:10 +0000 Subject: [PATCH] [HEAP] - RtlpInsertUnCommittedPages: Don't rely on linked list data in an UCR Descriptor after destroying it. No functionality change because the linked list data was still "as expected", but not something we want to rely on. - RtlpCreateUnCommittedRange: Fix a typo that caused the head of UCR Segment list of the Heap to be treated as an UCR Segment header. Side effects of the typo: When this list wasn't empty, the (fake) UCR Segment it described was grown to contain more UCR descriptors. Due to the data involved, this always happened to be the initial Heap Segment, which contains the Heap Header. Writing the new UCR descriptors caused the Heap Header and trailing Heap Entries to be partially corrupted. svn path=/trunk/; revision=50978 --- reactos/lib/rtl/heap.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/reactos/lib/rtl/heap.c b/reactos/lib/rtl/heap.c index 31bab04c095..110e68b0993 100644 --- a/reactos/lib/rtl/heap.c +++ b/reactos/lib/rtl/heap.c @@ -414,7 +414,7 @@ RtlpCreateUnCommittedRange(PHEAP_SEGMENT Segment) if (IsListEmpty(&Heap->UCRList)) { /* Get a pointer to the first UCR segment */ - UcrSegment = CONTAINING_RECORD(&Heap->UCRSegments.Flink, HEAP_UCR_SEGMENT, ListEntry); + UcrSegment = CONTAINING_RECORD(Heap->UCRSegments.Flink, HEAP_UCR_SEGMENT, ListEntry); /* Check the list of UCR segments */ if (IsListEmpty(&Heap->UCRSegments) || @@ -539,8 +539,11 @@ RtlpInsertUnCommittedPages(PHEAP_SEGMENT Segment, Address = (ULONG_PTR)UcrDescriptor->Address; Size += UcrDescriptor->Size; - /* Remove it from the list and destroy it */ - RemoveEntryList(Current); + /* Advance to the next descriptor */ + Current = Current->Flink; + + /* Remove the current descriptor from the list and destroy it */ + RemoveEntryList(&UcrDescriptor->SegmentEntry); RtlpDestroyUnCommittedRange(Segment, UcrDescriptor); Segment->NumberOfUnCommittedRanges--;