{"id":96705,"date":"2017-07-27T07:00:00","date_gmt":"2017-07-27T21:00:00","guid":{"rendered":"https:\/\/blogs.msdn.microsoft.com\/oldnewthing\/?p=96705"},"modified":"2020-12-21T15:08:06","modified_gmt":"2020-12-21T23:08:06","slug":"20170727-00","status":"publish","type":"post","link":"https:\/\/devblogs.microsoft.com\/oldnewthing\/20170727-00\/?p=96705","title":{"rendered":"How am I supposed to free the memory the system allocates in the SetPrivateObjectSecurity function?"},"content":{"rendered":"<p>A customer noted that <a href=\"https:\/\/msdn.microsoft.com\/library\/windows\/desktop\/aa379580(v=vs.85).aspx\">the <code>Set\u00adPrivate\u00adObject\u00adSecurity<\/code> function<\/a> updates a pointer provided by the <code>Objects\u00adSecurity\u00adDescriptor<\/code> parameter. Since it may allocate a new security descriptor, that means that it needs to deallocate the old one. But what function does it use to free the old one? After all, the allocation function must match the deallocation function. Similarly, how should the new security descriptor be freed? (I say &#8220;similarly&#8221; because the two answers had better be the same!)<\/p>\n<p>The system allocates and frees the security descriptor from the proess heap, as reported by the <code>Get\u00adProcess\u00adHeap<\/code> function. The allocation function is <code>Heap\u00adAlloc<\/code> and the deallocation function is <code>Heap\u00adFree<\/code>. That means that the security descriptor you pass in must have been allocated with<\/p>\n<pre>    SecurityDescriptor = HeapAlloc(GetProcessHeap(), flags, size);\r\n<\/pre>\n<p>and then you pass the pointer like this:<\/p>\n<pre>    SetPrivateObjectSecurity(..., &amp;SecurityDescriptor, ...);\r\n    \/\/ or\r\n    SetPrivateObjectSecurityEx(..., &amp;SecurityDescriptor, ...);\r\n<\/pre>\n<p>and after the <code>Set\u00adPrivate\u00adObject\u00adSecurity<\/code> function is done, you must free the memory with<\/p>\n<pre>    HeapFree(GetProcessHeap(), SecurityDescriptor);\r\n<\/pre>\n<p>I wrote this post the same day that I submitted the change request to add this essential information to the documentation. We&#8217;ll see who wins.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>It comes from the process heap.<\/p>\n","protected":false},"author":1069,"featured_media":111744,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[25],"class_list":["post-96705","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-oldnewthing","tag-code"],"acf":[],"blog_post_summary":"<p>It comes from the process heap.<\/p>\n","_links":{"self":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/posts\/96705","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/users\/1069"}],"replies":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/comments?post=96705"}],"version-history":[{"count":0,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/posts\/96705\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/media\/111744"}],"wp:attachment":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/media?parent=96705"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/categories?post=96705"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/tags?post=96705"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}