HEAP and FarCry installer

Hope i don't bother you much, but i guess you would tell me...

I still have a problem with FarCry installer. During that i found
HEAP issue - based on assumption, that message "Heap invalid in-use
arena magic 00eefeee" is unhealthy.

So program allocates 6fc bytes at 0x14c160 and free those bytes at
the end of the following list, but immediately tries to free another
heap at 14c188 which belongs to the freed area already, right?. Also
there is no trace, that the program allocates that 14c188 memory. Is
that bug or nothing unusual?

Longer log attached.

0009:Call ntdll.RtlAllocateHeap(00110000,00000000,000006fc)
ret=7dfef944
0009:Ret  ntdll.RtlAllocateHeap() retval=0014c160 ret=7dfef944
0009:Call version.GetFileVersionInfoW(00157a88 L"C:\Program
Files\Common Files\InstallShield\Driver\9\Intel
32\IDriver.exe",00000000,000006fc,0014c160) ret=7dff45c1

...

0009:Ret  version.GetFileVersionInfoW() retval=00000001 ret=7dff45c1
0009:Call version.VerQueryValueW(0014c160,7e078b84
L"\",0034beec,0034bee4) ret=7dff45e7
0009:Ret  version.VerQueryValueW() retval=00000001 ret=7dff45e7
0009:Call ntdll.RtlFreeHeap(00110000,00000000,0014c160) ret=7dfefa1e
0009:Ret  ntdll.RtlFreeHeap() retval=00000001 ret=7dfefa1e
0009:Call ntdll.RtlFreeHeap(00110000,00000000,0014c188) ret=7dfefa1e
warn:heap:HEAP_ValidateInUseArena Heap 0x110000: invalid in-use
arena magic 00eefeee for 0x14c180
0009:Ret  ntdll.RtlFreeHeap() retval=00000000 ret=7dfefa1e

[Henri Verbeet]

2010/8/29  :
> Hope i don't bother you much, but i guess you would tell me...
>
> I still have a problem with FarCry installer. During that i found
> HEAP issue - based on assumption, that message "Heap invalid in-use
> arena magic 00eefeee" is unhealthy.
>
> So program allocates 6fc bytes at 0x14c160 and free those bytes at
> the end of the following list, but immediately tries to free another
> heap at 14c188 which belongs to the freed area already, right?. Also
> there is no trace, that the program allocates that 14c188 memory. Is
> that bug or nothing unusual?

Yeah, that looks like a bug, but from the log it's not clear that it
isn't just the application doing that. A good start would be to check
to what module the "ret" addresses for both the HeapAlloc() and the
HeapFree() (7dfef944 and 7dfefa1e in the log) belong. If that's the
application or one of its dlls it's likely just an application bug, if
on the other hand it's a Wine dll (e.g. msi) that's where you should
be looking.