[HEAP]

- RtlpInsertUnCommittedPages: Don't rely on linked list data in an UCR Descriptor after destroying it.
  No functionality change because the linked list data was still "as expected", but not something we want to rely on.
- RtlpCreateUnCommittedRange: Fix a typo that caused the head of UCR Segment list of the Heap to be treated as an UCR Segment header.
  Side effects of the typo: When this list wasn't empty, the (fake) UCR Segment it described was grown to contain more UCR descriptors.
  Due to the data involved, this always happened to be the initial Heap Segment, which contains the Heap Header.
  Writing the new UCR descriptors caused the Heap Header and trailing Heap Entries to be partially corrupted.

svn path=/trunk/; revision=50978

diff --git a/reactos/lib/rtl/heap.c b/reactos/lib/rtl/heap.c
index 31bab04..110e68b 100644 (file)
--- a/reactos/lib/rtl/heap.c
+++ b/reactos/lib/rtl/heap.c
@@ -414,7 +414,7 @@ RtlpCreateUnCommittedRange(PHEAP_SEGMENT Segment)
     if (IsListEmpty(&Heap->UCRList))
     {
         /* Get a pointer to the first UCR segment */
     if (IsListEmpty(&Heap->UCRList))
     {
         /* Get a pointer to the first UCR segment */

-        UcrSegment = CONTAINING_RECORD(&Heap->UCRSegments.Flink, HEAP_UCR_SEGMENT, ListEntry);
+        UcrSegment = CONTAINING_RECORD(Heap->UCRSegments.Flink, HEAP_UCR_SEGMENT, ListEntry);

 
         /* Check the list of UCR segments */
         if (IsListEmpty(&Heap->UCRSegments) ||
 
         /* Check the list of UCR segments */
         if (IsListEmpty(&Heap->UCRSegments) ||


@@ -539,8 +539,11 @@ RtlpInsertUnCommittedPages(PHEAP_SEGMENT Segment,
             Address = (ULONG_PTR)UcrDescriptor->Address;
             Size += UcrDescriptor->Size;
 
             Address = (ULONG_PTR)UcrDescriptor->Address;
             Size += UcrDescriptor->Size;
 

-            /* Remove it from the list and destroy it */
-            RemoveEntryList(Current);
+            /* Advance to the next descriptor */
+            Current = Current->Flink;
+
+            /* Remove the current descriptor from the list and destroy it */
+            RemoveEntryList(&UcrDescriptor->SegmentEntry);

             RtlpDestroyUnCommittedRange(Segment, UcrDescriptor);
 
             Segment->NumberOfUnCommittedRanges--;
             RtlpDestroyUnCommittedRange(Segment, UcrDescriptor);
 
             Segment->NumberOfUnCommittedRanges--;