Possible false positive leak detection in AddSidToBoundaryDescriptor routing.

_From [mxm...@gmail.com](https://code.google.com/u/101248221827060668005/) on May 03, 2014 04:37:29_

DrMemory reports next:
Error `#1`: LEAK 72 direct bytes 0x01650ad8-0x01650b20 + 0 indirect bytes
#0 replace_RtlAllocateHeap [c:\drmemory\common\alloc_replace.c:3076]
#1 ntdll.dll!RtlAddSIDToBoundaryDescriptor +0x55 (0x77cc542e )
#2 KERNEL32.dll!AddSIDToBoundaryDescriptor +0x10 (0x766063aa )
#3 test_create_open_namespace
#4 main

RtlAddSIDToBoundaryDescriptor pseudocode looks like:
RtlAddSIDToBoundaryDescriptor(hboundary, SID, NULL)
{
if (RtlValidSid(SID)) // check SID
{
length_sid = RtlLengthRequiredSid(sizeof(SID)+sizeof(hBoundary)+8); // set required length for
if ( length_sid + *(DWORD)(hBoundary + 8) < length_sid ) // check length
{
result = SOME_ERROR_CODE;
}
else
{
heap_base_address = RtlAllocateHeap(hBoundary,8,72); // Allocate heap
heap_base_address_use = heap_base_address;
if ( heap_base_address )
{
HERE routine performs memcpy Boundary HANDLE and Boundary STR to heap_base_address

```
length_sid_2 = ntdll_RtlLengthRequiredSid(sizeof(SID)); // Why again?

HERE additional memcpy SID to heap_base_address after Boundary HANDLE and Boundary STR;

v9 = some_very_long_and_complex_check_function(heap_address_use, length_sid_2);

if ( v9 \< 0 )
{
RtlFreeHeap(hBoundary, 0, heap_base_address_use);
result = v9;
}
else
{
RtlFreeHeap(hBoundary, 0, &hBoundary); // why they free hBoundary?
result = SUCCESS;
}
}
else
{
result = SOME_ERROR_CODE;
}
}
```

So, I think, They allocate heap and copy Boundary HANDLE, Boundary STR and SID together for future use (e.g. CreatePrivateNamespace routine requires this association). After all they close first copy of Boundary HANDLE. If this correct, this is false positive but I may be wrong. Need additional check.

_Original issue: http://code.google.com/p/drmemory/issues/detail?id=1535_