Paul Gofman (@gofman) commented about server/process.c:
- }
- while (ptr)
- {
process = LIST_ENTRY( ptr, struct process, entry );
if ((reply->handle = alloc_handle( current->process, process, req->access, req->attributes )))
break;
ptr = req->flags ? list_prev( &process_list, &process->entry )
: list_next( &process_list, &process->entry );
- }
- if (!reply->handle)
set_error( STATUS_NO_MORE_ENTRIES );
- if (process)
release_object( process );
This release_object is off, it looks like for the only case when you are trying to reference the process above there is already matching release.