[PATCH v2 2/4] ntdll: Validate subheap's owner heap when validating heap.

[Jinoh Kang]

From: Jinoh Kang

---
 dlls/ntdll/heap.c | 16 +++++++++-------
 1 file changed, 9 insertions(+), 7 deletions(-)

diff --git a/dlls/ntdll/heap.c b/dlls/ntdll/heap.c
index 523344fe0f5..3c892e7fffc 100644
--- a/dlls/ntdll/heap.c
+++ b/dlls/ntdll/heap.c
@@ -338,8 +338,10 @@ static inline struct block *next_block( const SUBHEAP *subheap, const struct blo
     return (struct block *)next;
 }

-static inline BOOL check_subheap( const SUBHEAP *subheap )
+static inline BOOL check_subheap( const SUBHEAP *subheap, const struct heap *heap )
 {
+    if (heap && subheap->user_value != heap) return FALSE;
+
     return contains( &subheap->block, subheap->block_size, subheap + 1, subheap->data_size );
 }

@@ -453,7 +455,7 @@ static void valgrind_notify_free_all( SUBHEAP *subheap )
     struct block *block;

if (!RUNNING_ON_VALGRIND) return;
-    if (!check_subheap( subheap )) return;
+    if (!check_subheap( subheap, NULL )) return;

for (block = first_block( subheap ); block; block = next_block( subheap, block ))
     {
@@ -549,7 +551,7 @@ static void heap_dump( const struct heap *heap )
         TRACE( "    %p: base %p first %p last %p end %p\n", subheap, base, first_block( subheap ),
                last_block( subheap ), base + subheap_size( subheap ) );

-        if (!check_subheap( subheap )) return;
+        if (!check_subheap( subheap, heap )) return;

overhead += subheap_overhead( subheap );
         for (block = first_block( subheap ); block; block = next_block( subheap, block ))
@@ -648,7 +650,7 @@ static SUBHEAP *find_subheap( const struct heap *heap, const struct block *block
     LIST_FOR_EACH_ENTRY( subheap, &heap->subheap_list, SUBHEAP, entry )
     {
         SIZE_T blocks_size = (char *)last_block( subheap ) - (char *)first_block( subheap );
-        if (!check_subheap( subheap )) return NULL;
+        if (!check_subheap( subheap, heap )) return NULL;
         if (contains( first_block( subheap ), blocks_size, block, sizeof(*block) )) return subheap;
         /* outside of blocks region, possible corruption or heap_walk */
         if (contains( subheap_base( subheap ), subheap_size( subheap ), block, 0 )) return heap_walk ? subheap : NULL;
@@ -1152,9 +1154,9 @@ static BOOL heap_validate( const struct heap *heap )

LIST_FOR_EACH_ENTRY( subheap, &heap->subheap_list, SUBHEAP, entry )
     {
-        if (!check_subheap( subheap ))
+        if (!check_subheap( subheap, heap ))
         {
-            ERR( "heap %p, subheap %p corrupted sizes\n", heap, subheap );
+            ERR( "heap %p, subheap %p corrupted sizes or user_value\n", heap, subheap );
             if (TRACE_ON(heap)) heap_dump( heap );
             return FALSE;
         }
@@ -1271,7 +1273,7 @@ static void heap_set_debug_flags( HANDLE handle )
         {
             const char *commit_end = subheap_commit_end( subheap );

-            if (!check_subheap( subheap )) break;
+            if (!check_subheap( subheap, heap )) break;

for (block = first_block( subheap ); block; block = next_block( subheap, block ))
             {