Intravision/reactos
1
0
Fork 0
mirror of https://github.com/reactos/reactos.git synced 2025-08-05 18:42:56 +00:00
Code Issues Projects Releases Packages Wiki Activity

[RTL] Protect pointer validity check in RtlFreeHeap with SEH.

Browse source 
Fixes crash in kernel32_winetest:heap.
This commit is contained in:
Thomas Faber 2019-02-03 13:57:21 +01:00
parent 3ddf59e1ed
commit 7246909a80
No known key found for this signature in database
GPG key ID: 076E7C3D44720826
1 changed files with 25 additions and 17 deletions
Download patch file Download diff file Expand all files Collapse all files

28
sdk/lib/rtl/heap.c
View file

@ -2180,16 +2180,12 @@ BOOLEAN NTAPI RtlFreeHeap(
if (RtlpHeapIsSpecial(Flags)) if (RtlpHeapIsSpecial(Flags))
return RtlDebugFreeHeap(Heap, Flags, Ptr); return RtlDebugFreeHeap(Heap, Flags, Ptr);
/* Lock if necessary */
if (!(Flags & HEAP_NO_SERIALIZE))
{
RtlEnterHeapLock(Heap->LockVariable, TRUE);
Locked = TRUE;
}
/* Get pointer to the heap entry */ /* Get pointer to the heap entry */
HeapEntry = (PHEAP_ENTRY)Ptr - 1; HeapEntry = (PHEAP_ENTRY)Ptr - 1;
/* Protect with SEH in case the pointer is not valid */
_SEH2_TRY
{
/* Check this entry, fail if it's invalid */ /* Check this entry, fail if it's invalid */
if (!(HeapEntry->Flags & HEAP_ENTRY_BUSY) || if (!(HeapEntry->Flags & HEAP_ENTRY_BUSY) ||
(((ULONG_PTR)Ptr & 0x7) != 0) || (((ULONG_PTR)Ptr & 0x7) != 0) ||
@ -2198,10 +2194,22 @@ BOOLEAN NTAPI RtlFreeHeap(
/* This is an invalid block */ /* This is an invalid block */
DPRINT1("HEAP: Trying to free an invalid address %p!\n", Ptr); DPRINT1("HEAP: Trying to free an invalid address %p!\n", Ptr);
RtlSetLastWin32ErrorAndNtStatusFromNtStatus(STATUS_INVALID_PARAMETER); RtlSetLastWin32ErrorAndNtStatusFromNtStatus(STATUS_INVALID_PARAMETER);
_SEH2_YIELD(return FALSE);
}
}
_SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
{
/* The pointer was invalid */
DPRINT1("HEAP: Trying to free an invalid address %p!\n", Ptr);
RtlSetLastWin32ErrorAndNtStatusFromNtStatus(STATUS_INVALID_PARAMETER);
_SEH2_YIELD(return FALSE);
}
/* Release the heap lock */ /* Lock if necessary */
if (Locked) RtlLeaveHeapLock(Heap->LockVariable); if (!(Flags & HEAP_NO_SERIALIZE))
return FALSE; {
RtlEnterHeapLock(Heap->LockVariable, TRUE);
Locked = TRUE;
} }
if (HeapEntry->Flags & HEAP_ENTRY_VIRTUAL_ALLOC) if (HeapEntry->Flags & HEAP_ENTRY_VIRTUAL_ALLOC)