From 98b2bae8db248411786eb05a354ae6a37e8a8ccf Mon Sep 17 00:00:00 2001
From: Thomas Faber <thomas.faber@reactos.org>
Date: Sun, 12 Oct 2014 11:23:05 +0000
Subject: [PATCH] [EVENTLOG] - In ElfGetLogHandleEntryByHandle, actually verify
 the validity of the handle by traversing the log handle list. Fixes crash in
 advapi32_winetest:eventlog (double close). - Minor style improvements to
 ElfDeleteEventLogHandle CORE-8621 #resolve

svn path=/trunk/; revision=64689
---
 reactos/base/services/eventlog/rpc.c | 27 ++++++++++++++++++---------
 1 file changed, 18 insertions(+), 9 deletions(-)

diff --git a/reactos/base/services/eventlog/rpc.c b/reactos/base/services/eventlog/rpc.c
index e7a6ac42aed..99f8d723ac6 100644
--- a/reactos/base/services/eventlog/rpc.c
+++ b/reactos/base/services/eventlog/rpc.c
@@ -196,31 +196,40 @@ Done:
 
 PLOGHANDLE ElfGetLogHandleEntryByHandle(IELF_HANDLE EventLogHandle)
 {
+    PLIST_ENTRY CurrentEntry;
     PLOGHANDLE lpLogHandle;
 
-    if (IsListEmpty(&LogHandleListHead))
+    CurrentEntry = LogHandleListHead.Flink;
+    while (CurrentEntry != &LogHandleListHead)
     {
-        return NULL;
+        lpLogHandle = CONTAINING_RECORD(CurrentEntry,
+                                        LOGHANDLE,
+                                        LogHandleListEntry);
+        CurrentEntry = CurrentEntry->Flink;
+
+        if (lpLogHandle == EventLogHandle)
+            return lpLogHandle;
     }
 
-    lpLogHandle = CONTAINING_RECORD((PLOGHANDLE)EventLogHandle, LOGHANDLE, LogHandleListEntry);
-
-    return lpLogHandle;
+    return NULL;
 }
 
 
 static NTSTATUS
-ElfDeleteEventLogHandle(IELF_HANDLE EventLogHandle)
+ElfDeleteEventLogHandle(IELF_HANDLE LogHandle)
 {
-    PLOGHANDLE lpLogHandle = (PLOGHANDLE)EventLogHandle;
+    PLOGHANDLE lpLogHandle;
 
-    if (!ElfGetLogHandleEntryByHandle(lpLogHandle))
+    lpLogHandle = ElfGetLogHandleEntryByHandle(LogHandle);
+    if (!lpLogHandle)
+    {
         return STATUS_INVALID_HANDLE;
+    }
 
     RemoveEntryList(&lpLogHandle->LogHandleListEntry);
     LogfClose(lpLogHandle->LogFile, FALSE);
 
-    HeapFree(GetProcessHeap(),0,lpLogHandle);
+    HeapFree(GetProcessHeap(), 0, lpLogHandle);
 
     return STATUS_SUCCESS;
 }