[ros-diffs] [sir_richard] 49556: [NTOS]: Fix another bug in the continuous memory allocation code, which would go off-by-one while looping the PFN entries for the allocation, and corrupt the PteFrame/PteAddres...

Author: sir_richard
Date: Thu Nov 11 13:05:52 2010
New Revision: 49556

URL: http://svn.reactos.org/svn/reactos?rev=49556&view=rev
Log:
[NTOS]: Fix another bug in the continuous memory allocation code, which would go
off-by-one while looping the PFN entries for the allocation, and corrupt the
PteFrame/PteAddress of an unrelated PFN entry. If this PFN was in the active lists, it
would cause page table leaks and faults, if the page was on a free list, it would override
the colored list backlink and corrupt the list, later causing unlinked pages to remain
linked to the list.

Modified:
    trunk/reactos/ntoskrnl/mm/ARM3/contmem.c

Modified: trunk/reactos/ntoskrnl/mm/ARM3/contmem.c
URL:
http://svn.reactos.org/svn/reactos/trunk/reactos/ntoskrnl/mm/ARM3/contmem.c…
==============================================================================
--- trunk/reactos/ntoskrnl/mm/ARM3/contmem.c [iso-8859-1] (original)
+++ trunk/reactos/ntoskrnl/mm/ARM3/contmem.c [iso-8859-1] Thu Nov 11 13:05:52 2010
@@ -79,7 +79,6 @@
             //
             if (MiIsPfnInUse(Pfn1))
             {
-                //DPRINT1("In use: reset\n");
                 Length = 0;
                 continue;
             }
@@ -94,7 +93,6 @@
                 //
                 // It does not, so bail out
                 //
-                //DPRINT1("Doesn't match restrictions: reset\n");
                 continue;
             }
             
@@ -368,7 +366,7 @@
         /* Write the PTE address */
         Pfn1->PteAddress = PointerPte;
         Pfn1->u4.PteFrame = PFN_FROM_PTE(MiAddressToPte(PointerPte++));
-    } while (Pfn1++ < EndPfn);
+    } while (++Pfn1 < EndPfn);
     
     /* Return the address */
     return BaseAddress;