Jinoh Kang (@iamahuman) commented about dlls/ntdll/heap.c:
+{
- ULONG affinity = heap_current_thread_affinity();
- struct block *block;
- struct group *group;
- /* acquire a group, the thread will own it and no other thread can clear free bits.
* some other thread might still set the free bits if they are freeing blocks.
*/
- if (!(group = heap_acquire_bin_group( heap, flags, block_size, bin ))) return NULL;
- group->affinity = affinity;
- /* serialize with heap_free_block_lfh: atomically set GROUP_FLAG_FREE when the free bits are all 0. */
- if (group_find_free_block( group, block_size, &block ))
InterlockedAnd( &group->free_bits, ~GROUP_FLAG_FREE );
- else
InterlockedCompareExchange( &group->free_bits, GROUP_FLAG_FREE, 0 );
Try reusing the `InterlockedCompareExchange`'s value instead. Read free bits, compare against zero, do the cmpxchg if equal, and _then_ use its value for the if statement below.