Fix part two of the bug:

The actual problem was that we'd overrun the end of the handle count array
when decrementing.  This also led to a handle leak (observed).  Stop correctly
when we find the handle we want.

svn path=/trunk/; revision=28415
This commit is contained in:
Art Yerkes 2007-08-19 05:02:31 +00:00
parent edceb16713
commit 7acf61114d

View file

@ -331,6 +331,8 @@ ObpIncrementHandleDataBase(IN POBJECT_HEADER ObjectHeader,
/* Insert a new entry */
FreeEntry = ObpInsertHandleCount(ObjectHeader);
if (!FreeEntry) return STATUS_INSUFFICIENT_RESOURCES;
ASSERT(!FreeEntry->Process);
ASSERT(!FreeEntry->HandleCount);
/* Fill it out */
FreeEntry->Process = Process;
@ -375,6 +377,8 @@ ObpIncrementHandleDataBase(IN POBJECT_HEADER ObjectHeader,
/* Allocate one */
FreeEntry = ObpInsertHandleCount(ObjectHeader);
if (!FreeEntry) return STATUS_INSUFFICIENT_RESOURCES;
ASSERT(!FreeEntry->Process);
ASSERT(!FreeEntry->HandleCount);
}
/* Fill out the entry */
@ -533,6 +537,7 @@ ObpDecrementHandleCount(IN PVOID ObjectBody,
{
/* Found it, get the process handle count */
ProcessHandleCount = HandleEntry->HandleCount--;
break;
}
/* Keep looping */