RE: ZLib double free bug: Windows NT potentially unaffected

["Robert Collins" <robert.collins () itdomain com au>]

> -----Original Message-----
> From: KJK::Hyperion [mailto:noog () libero it] 
> Sent: Friday, March 15, 2002 4:52 AM
> To: bugtraq () securityfocus com
> Subject: ZLib double free bug: Windows NT potentially unaffected


> I allocate 4 kb of memory, then I free the block twice. Under 
> debugging, 
> this program will emit the following diagnostic message:
>
> HEAP[testheap.exe]: Invalid Address specified to RtlFreeHeap( 
> 130000, 1357f0 )
>
> immediately after this, a breakpoint exception (code 
> 0x80000003) is raised. 
> So, apparently, the second free operation degrades 
> gracefully, apparently 
> without any corruption of in-memory structures, since the subsequent 
> allocation/deallocation runs fine

Can I suggest you try it with a non-debug build. I've seen heap
corruption occur in winNT software, that in debug-builds was trapped,
but in non-debug builds was not.

Cheers,
Rob