[PATCH] ntdll: Fix trace pointer returned from RtlGetUnloadEventTraceEx().

[Nikolay Sivov]

Signed-off-by: Nikolay Sivov 
---

Issue was spotted in CEF/crashpad logs. Relevant code is in
process_snapshot_win.cc:ProcessSnapshotWin::InitializeUnloadedModules().

dlls/ntdll/loader.c          |  4 +++-
 dlls/ntdll/tests/exception.c | 26 +++++++++++++++++++++-----
 2 files changed, 24 insertions(+), 6 deletions(-)

diff --git a/dlls/ntdll/loader.c b/dlls/ntdll/loader.c
index b946416734..23fde1f516 100644
--- a/dlls/ntdll/loader.c
+++ b/dlls/ntdll/loader.c
@@ -197,6 +197,7 @@ typedef struct _RTL_UNLOAD_EVENT_TRACE
 } RTL_UNLOAD_EVENT_TRACE, *PRTL_UNLOAD_EVENT_TRACE;

static RTL_UNLOAD_EVENT_TRACE unload_traces[RTL_UNLOAD_EVENT_TRACE_NUMBER];
+static RTL_UNLOAD_EVENT_TRACE *unload_trace_ptr;
 static unsigned int unload_trace_seq;

static void module_push_unload_trace( const LDR_MODULE *ldr )
@@ -213,6 +214,7 @@ static void module_push_unload_trace( const LDR_MODULE *ldr )
     ptr->ImageName[len / sizeof(*ptr->ImageName)] = 0;

unload_trace_seq = (unload_trace_seq + 1) % ARRAY_SIZE(unload_traces);
+    unload_trace_ptr = unload_traces;
 }

/*********************************************************************
@@ -233,7 +235,7 @@ void WINAPI RtlGetUnloadEventTraceEx(ULONG **size, ULONG **count, void **trace)

*size = &element_size;
     *count = &element_count;
-    *trace = unload_traces;
+    *trace = &unload_trace_ptr;
 }

/*************************************************************************
diff --git a/dlls/ntdll/tests/exception.c b/dlls/ntdll/tests/exception.c
index 249ba9d7c3..72afb0a376 100644
--- a/dlls/ntdll/tests/exception.c
+++ b/dlls/ntdll/tests/exception.c
@@ -3410,21 +3410,20 @@ static void test_suspend_process(void)
 static void test_unload_trace(void)
 {
     static const WCHAR imageW[] = {'m','s','x','m','l','3','.','d','l','l',0};
-    RTL_UNLOAD_EVENT_TRACE *unload_trace, *ptr;
+    RTL_UNLOAD_EVENT_TRACE *unload_trace, **unload_trace_ex = NULL, *ptr;
     ULONG *element_size, *element_count, size;
-    BOOL found = FALSE;
     HMODULE hmod;
+    BOOL found;

unload_trace = pRtlGetUnloadEventTrace();
     ok(unload_trace != NULL, "Failed to get unload events pointer.\n");

if (pRtlGetUnloadEventTraceEx)
     {
-        ptr = NULL;
-        pRtlGetUnloadEventTraceEx(&element_size, &element_count, (void **)&ptr);
+        pRtlGetUnloadEventTraceEx(&element_size, &element_count, (void **)&unload_trace_ex);
         ok(*element_size >= sizeof(*ptr), "Unexpected element size.\n");
         ok(*element_count == RTL_UNLOAD_EVENT_TRACE_NUMBER, "Unexpected trace element count %u.\n", *element_count);
-        ok(ptr != NULL, "Unexpected pointer %p.\n", ptr);
+        ok(unload_trace_ex != NULL, "Unexpected pointer %p.\n", unload_trace_ex);
         size = *element_size;
     }
     else
@@ -3434,6 +3433,7 @@ static void test_unload_trace(void)
     ok(hmod != NULL, "Failed to load library.\n");
     FreeLibrary(hmod);

+    found = FALSE;
     ptr = unload_trace;
     while (ptr->BaseAddress != NULL)
     {
@@ -3445,6 +3445,22 @@ static void test_unload_trace(void)
         ptr = (RTL_UNLOAD_EVENT_TRACE *)((char *)ptr + size);
     }
     ok(found, "Unloaded module wasn't found.\n");
+
+    if (unload_trace_ex)
+    {
+        found = FALSE;
+        ptr = *unload_trace_ex;
+        while (ptr->BaseAddress != NULL)
+        {
+            if (!lstrcmpW(imageW, ptr->ImageName))
+            {
+                found = TRUE;
+                break;
+            }
+            ptr = (RTL_UNLOAD_EVENT_TRACE *)((char *)ptr + size);
+        }
+        ok(found, "Unloaded module wasn't found.\n");
+    }
 }

START_TEST(exception)