Stack corruption in dsound.c

wylda at volny.cz wylda at volny.cz
Thu May 6 02:57:55 CDT 2010


> > #274 before wined3d_mutex_unlock(), 0x0020a3f0=HeapAlloc(),
> > #274 after wined3d_mutex_unlock(),  0x18fa7048=HeapAlloc()
> > ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
> >
> What exactly is wrong with that address?

Hi Henri, to my understending, when i take real values:

adr1 = HeapAlloc(0x00110000, 0x00000008, 0x000003d4);
HeapFree (0x00110000, 0, adr1);

adr2 = HeapAlloc(0x00110000, 0x00000008, 0x000003d4);
HeapFree (0x00110000, 0, adr2);

Allocates me 3E0 (rounded 3d4) bytes filled with zeros, begining at adr1
and this:
a) adr1 should be "relatively close" to the 0x00110000
b) adr1 should be same as adr2

Both these a) and b) perfectly works 273 times, when injected in funtion
wined3d_mutex_unlock(). So that makes me believe, that there is memory
on 274 entrance when calling LeaveCriticalSection(&wined3d_cs) inside
wined3d_mutex_unlock().

> Stefan Dösinger:
> There's HeapValidate which may be better than Alloc+Free in spotting
> > bugs.

Hi, this kind of help i'm looking for... Furhter googling lead me to
nice articles about memory damage.

BTW: why it takes so long (cca 6 hours) a post to appear, when i send
mail to wine-devel? Some kind of mail graylist?





More information about the wine-devel mailing list