From 7a158b7f2dc1c533efcb64460d8d7f95c85adddf Mon Sep 17 00:00:00 2001
From: Aleksey Bragin <aleksey@reactos.org>
Date: Mon, 21 Jul 2008 09:40:12 +0000
Subject: [PATCH] Yuriy Sidorov <jura@cp-lab.com> - Invalid parameter error is
 returned if requested memory area is located above USER_SHARED_DATA address
 (0x7FFE0000) (WinXP compatible). - Access violation error is returned if
 existing memory area found on requested address and this area have
 uninitialized region list. See issue #3467 for more details.

svn path=/trunk/; revision=34630
---
 reactos/ntoskrnl/mm/anonmem.c | 25 +++++++++++++++++--------
 1 file changed, 17 insertions(+), 8 deletions(-)

diff --git a/reactos/ntoskrnl/mm/anonmem.c b/reactos/ntoskrnl/mm/anonmem.c
index ae35f0288bc..5a14de50088 100644
--- a/reactos/ntoskrnl/mm/anonmem.c
+++ b/reactos/ntoskrnl/mm/anonmem.c
@@ -656,7 +656,7 @@ NtAllocateVirtualMemory(IN     HANDLE ProcessHandle,
     * Yes, MmCreateMemoryArea does similar checks, but they don't return
     * the right status codes that a caller of this routine would expect.
     */
-   if (BaseAddress >= MM_HIGHEST_USER_ADDRESS)
+   if ((ULONG_PTR)BaseAddress >= USER_SHARED_DATA)
    {
       DPRINT1("Virtual allocation base above User Space\n");
       return STATUS_INVALID_PARAMETER_2;
@@ -666,7 +666,7 @@ NtAllocateVirtualMemory(IN     HANDLE ProcessHandle,
       DPRINT1("Region size is invalid (zero)\n");
       return STATUS_INVALID_PARAMETER_4;
    }
-   if (((ULONG_PTR)MM_HIGHEST_USER_ADDRESS - (ULONG_PTR)BaseAddress) < RegionSize)
+   if ((USER_SHARED_DATA - (ULONG_PTR)BaseAddress) < RegionSize)
    {
       DPRINT1("Region size would overflow into kernel-memory\n");
       return STATUS_INVALID_PARAMETER_4;
@@ -726,12 +726,21 @@ NtAllocateVirtualMemory(IN     HANDLE ProcessHandle,
          }
          else if (MemoryAreaLength >= RegionSize)
          {
-            Status =
-               MmAlterRegion(AddressSpace,
-                             MemoryArea->StartingAddress,
-                             &MemoryArea->Data.SectionData.RegionListHead,
-                             BaseAddress, RegionSize,
-                             Type, Protect, MmModifyAttributes);
+            /* Region list initialized? */
+            if (MemoryArea->Data.SectionData.RegionListHead.Flink)
+            {
+               Status =
+                  MmAlterRegion(AddressSpace,
+                                MemoryArea->StartingAddress,
+                                &MemoryArea->Data.SectionData.RegionListHead,
+                                BaseAddress, RegionSize,
+                                Type, Protect, MmModifyAttributes);
+            }
+            else
+            {
+               Status = STATUS_ACCESS_VIOLATION;
+            }
+
             MmUnlockAddressSpace(AddressSpace);
             ObDereferenceObject(Process);
             DPRINT("NtAllocateVirtualMemory() = %x\n",Status);