From 285991f04c8df9a205433be5c54bd9dfe69c283a Mon Sep 17 00:00:00 2001
From: Thomas Faber <thomas.faber@reactos.org>
Date: Sun, 30 Aug 2015 07:26:26 +0000
Subject: [PATCH] [RTL] - Use the correct busy node pointer in
 RtlpPageHeapDestroy CORE-9735 #resolve

svn path=/trunk/; revision=68866
---
 reactos/lib/rtl/heappage.c | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/reactos/lib/rtl/heappage.c b/reactos/lib/rtl/heappage.c
index 07dd6c09775..94f1a409b4c 100644
--- a/reactos/lib/rtl/heappage.c
+++ b/reactos/lib/rtl/heappage.c
@@ -1266,7 +1266,7 @@ RtlpDphFreeDelayedBlocksFromHeap(PDPH_HEAP_ROOT DphRoot,
             RtlpDphNumberOfDelayedFreeBlocks--;
 
             /* Free the normal heap */
-            RtlFreeHeap (NormalHeap, 0, BlockInfo);
+            RtlFreeHeap(NormalHeap, 0, BlockInfo);
         }
 
         /* Move to the next one */
@@ -1613,6 +1613,7 @@ PVOID NTAPI
 RtlpPageHeapDestroy(HANDLE HeapPtr)
 {
     PDPH_HEAP_ROOT DphRoot;
+    PVOID Ptr;
     PDPH_HEAP_BLOCK Node, Next;
     PHEAP NormalHeap;
     ULONG Value;
@@ -1637,10 +1638,11 @@ RtlpPageHeapDestroy(HANDLE HeapPtr)
     RtlpDphFreeDelayedBlocksFromHeap(DphRoot, NormalHeap);
 
     /* Go through the busy blocks */
-    Node = RtlEnumerateGenericTableAvl(&DphRoot->BusyNodesTable, TRUE);
+    Ptr = RtlEnumerateGenericTableAvl(&DphRoot->BusyNodesTable, TRUE);
 
-    while (Node)
+    while (Ptr)
     {
+        Node = CONTAINING_RECORD(Ptr, DPH_HEAP_BLOCK, pUserAllocation);
         if (!(DphRoot->ExtraFlags & DPH_EXTRA_CHECK_UNDERRUN))
         {
             if (!RtlpDphIsPageHeapBlock(DphRoot, Node->pUserAllocation, &Value, TRUE))
@@ -1653,7 +1655,7 @@ RtlpPageHeapDestroy(HANDLE HeapPtr)
         //AVrfInternalHeapFreeNotification();
 
         /* Go to the next node */
-        Node = RtlEnumerateGenericTableAvl(&DphRoot->BusyNodesTable, FALSE);
+        Ptr = RtlEnumerateGenericTableAvl(&DphRoot->BusyNodesTable, FALSE);
     }
 
     /* Acquire the global heap list lock */
-- 
2.17.1