From f0c36353f38e6cfcde1e4ea9439c21d601ec622c Mon Sep 17 00:00:00 2001
From: Thomas Faber <thomas.faber@reactos.org>
Date: Fri, 13 Feb 2015 10:11:50 +0000
Subject: [PATCH] [WIN32K:NTUSER] - Assert sanity of object reference counts in
 UserReferenceObject, UserDereferenceObject and UserDeleteObject. If you hit a
 cLockObj < 0x10000 assertion failure, you found yourself a use after free
 (RtlFreeHeap will put a LIST_ENTRY in this location, so a freed item has a
 kernel pointer there). See CORE-8703 for an example.

svn path=/trunk/; revision=66243
---
 reactos/win32ss/user/ntuser/object.c | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/reactos/win32ss/user/ntuser/object.c b/reactos/win32ss/user/ntuser/object.c
index 39633146a5d..b6c47e0c1d5 100644
--- a/reactos/win32ss/user/ntuser/object.c
+++ b/reactos/win32ss/user/ntuser/object.c
@@ -586,9 +586,10 @@ BOOL
 FASTCALL
 UserDereferenceObject(PVOID Object)
 {
-    PHEAD ObjHead = (PHEAD)Object;
+    PHEAD ObjHead = Object;
 
     ASSERT(ObjHead->cLockObj >= 1);
+    ASSERT(ObjHead->cLockObj < 0x10000);
 
     if (--ObjHead->cLockObj == 0)
     {
@@ -663,6 +664,7 @@ UserDeleteObject(HANDLE h, HANDLE_TYPE type )
    if (!body) return FALSE;
 
    ASSERT( ((PHEAD)body)->cLockObj >= 1);
+   ASSERT( ((PHEAD)body)->cLockObj < 0x10000);
 
    return UserFreeHandle(gHandleTable, h);
 }
@@ -671,9 +673,11 @@ VOID
 FASTCALL
 UserReferenceObject(PVOID obj)
 {
-   ASSERT(((PHEAD)obj)->cLockObj >= 0);
+   PHEAD ObjHead = obj;
+   ASSERT(ObjHead->cLockObj >= 0);
+   ASSERT(ObjHead->cLockObj < 0x10000);
 
-   ((PHEAD)obj)->cLockObj++;
+   ObjHead->cLockObj++;
 }
 
 PVOID