ntdll: Correctly free pending pointer in RtlDestroyHeap.

It's allocated from the heap itself, should be freed even for the main process heap, and before destroying the CS or notifying valgrind of used block being freed. Signed-off-by: Rémi Bernon <rbernon@codeweavers.com>

ntdll: Correctly free pending pointer in RtlDestroyHeap.
3f52b3a7 · Rémi Bernon · Alexandre Julliard · e4e8cabf · 3f52b3a7
Commit 3f52b3a7 authored May 30, 2022 by Rémi Bernon Committed by Alexandre Julliard May 31, 2022
Hide whitespace changes
Inline Side-by-side

Showing with 10 additions and 1 deletion

heap.c dlls/ntdll/heap.c +10 -1

No files found.
--- a/dlls/ntdll/heap.c
+++ b/dlls/ntdll/heap.c
@@ -1431,6 +1431,7 @@ HANDLE WINAPI RtlDestroyHeap( HANDLE heap )
    HEAP *heapPtr = HEAP_GetPtr( heap );
    SUBHEAP *subheap, *next;
    ARENA_LARGE *arena, *arena_next;
+    struct block **pending, **tmp;
    SIZE_T size;
    void *addr;

@@ -1443,6 +1444,15 @@ HANDLE WINAPI RtlDestroyHeap( HANDLE heap )
    }
    if (!heapPtr) return heap;

+    if ((pending = heapPtr->pending_free))
+    {
+        heapPtr->pending_free = NULL;
+        for (tmp = pending; *tmp && tmp != pending + MAX_FREE_PENDING; ++tmp)
+            if ((subheap = find_subheap( heap, *tmp, FALSE )))
+                free_used_block( subheap, *tmp );
+        RtlFreeHeap( heap, 0, pending );
+    }
+
    if (heap == processHeap) return heap; /* cannot delete the main process heap */

    /* remove it from the per-process list */
@@ -1470,7 +1480,6 @@ HANDLE WINAPI RtlDestroyHeap( HANDLE heap )
        NtFreeVirtualMemory( NtCurrentProcess(), &addr, &size, MEM_RELEASE );
    }
    notify_free_all( &heapPtr->subheap );
-    RtlFreeHeap( GetProcessHeap(), 0, heapPtr->pending_free );
    size = 0;
    addr = heap;
    NtFreeVirtualMemory( NtCurrentProcess(), &addr, &size, MEM_RELEASE );