Re: notoskrnl.exe: Fix the stack overflow bugs in raising exceptions(DLL_PROCESS_DETACH processing for DllMain in ntoskrnl.c)

[Dmitry Timoshkov]

"Anton Rudnev"  wrote:
> --- a/dlls/ntoskrnl.exe/ntoskrnl.c
> +++ b/dlls/ntoskrnl.exe/ntoskrnl.c
> @@ -886,14 +886,20 @@ NTSTATUS WINAPI PsSetCreateProcessNotifyRoutine( PCREATE_PROCESS_NOTIFY_ROUTINE
>  BOOL WINAPI DllMain( HINSTANCE inst, DWORD reason, LPVOID reserved )
>  {
>      LARGE_INTEGER count;
> -
>
> static vectored_handler_added = NULL;
>
> switch(reason)
> {
> case DLL_PROCESS_ATTACH:
>     DisableThreadLibraryCalls( inst );
> -
>    RtlAddVectoredExceptionHandler( TRUE, vectored_handler );
> -
>    vectored_handler_added = RtlAddVectoredExceptionHandler( TRUE, vectored_handler );
>    KeQueryTickCount( &count );  /* initialize the global KeTickCount */
>    break;
> - case DLL_PROCESS_DETACH:
> -
>    if(vectored_handler_added){
> -
>        RtlRemoveVectoredExceptionHandler(vectored_handler_added);
> -
>        vectored_handler_added = NULL;
> -
>    }
> }
>    return TRUE;
>
> }

What you want is find out why RtlAddVectoredExceptionHandler fails for you,
because it shouldn't fail normally.