Rémi Bernon : kernel32: Lock heap and validate pointer in LocalHandle.

[Alexandre Julliard]

Module: wine
Branch: master
Commit: c7eb844ce07557204a442c36c0679f9ecf46a8f7
URL:    https://gitlab.winehq.org/wine/wine/-/commit/c7eb844ce07557204a442c36c0679f9...

Author: Rémi Bernon <rbernon(a)codeweavers.com>
Date:   Sat Nov 12 14:27:44 2022 +0100

kernel32: Lock heap and validate pointer in LocalHandle.

---

 dlls/kernel32/heap.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/dlls/kernel32/heap.c b/dlls/kernel32/heap.c
index d433a703d16..9e1da01778d 100644
--- a/dlls/kernel32/heap.c
+++ b/dlls/kernel32/heap.c
@@ -343,6 +343,7 @@ UINT WINAPI LocalFlags( HLOCAL handle )
  */
 HLOCAL WINAPI LocalHandle( const void *ptr )
 {
+    HANDLE heap = GetProcessHeap();
     HLOCAL handle = (HANDLE)ptr;
     ULONG flags;
 
@@ -354,11 +355,14 @@ HLOCAL WINAPI LocalHandle( const void *ptr )
         return 0;
     }
 
-    if (!RtlGetUserInfoHeap( GetProcessHeap(), 0, (void *)ptr, &handle, &flags ))
+    RtlLockHeap( heap );
+    if (!HeapValidate( heap, HEAP_NO_SERIALIZE, ptr ) ||
+        !RtlGetUserInfoHeap( heap, HEAP_NO_SERIALIZE, (void *)ptr, &handle, &flags ))
     {
         SetLastError( ERROR_INVALID_HANDLE );
-        return 0;
+        handle = 0;
     }
+    RtlUnlockHeap( heap );
 
     return handle;
 }