Don't unpatch an unloaded module. We verify if the original function address ...

base/iat_patch.cc

 // Copyright (c) 2006-2008 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "base/iat_patch.h"
 #include "base/logging.h"
 
 namespace iat_patch {
 
 struct InterceptFunctionInformation {
@@ skipping 187 matching lines @@
 
   if (NO_ERROR == error) {
     DCHECK_NE(original_function_, intercept_function_);
     intercept_function_ = new_function;
   }
 
   return error;
 }
 
 DWORD IATPatchFunction::Unpatch() {
-  DWORD error = RestoreImportedFunction(intercept_function_,
-                                        original_function_,
-                                        iat_thunk_);
+  DWORD error = 0;  
+  MEMORY_BASIC_INFORMATION memory_info = {0};
+
+  // If the module has already unloaded, no point trying to unpatch.
+  if (!VirtualQuery(original_function_, &memory_info,
+                    sizeof(memory_info))) {
+    error = GetLastError();
+    NOTREACHED();
+    return error;
+  }

[Dean McNamee, 2009/02/18 11:35:38]

Shouldn't you set all of the functions to NULL here?

+
+  if ((memory_info.State  & MEM_COMMIT) != MEM_COMMIT) {
+    NOTREACHED();
+    return ERROR_ACCESS_DENIED;
+  }
+
+  error = RestoreImportedFunction(intercept_function_,
+                                  original_function_,
+                                  iat_thunk_);
   DCHECK(NO_ERROR == error);
 
   // Hands off the intercept if we fail to unpatch.
   // If IATPatchFunction::Unpatch fails during RestoreImportedFunction
   // it means that we cannot safely unpatch the import address table
   // patch. In this case its better to be hands off the intercept as
   // trying to unpatch again in the destructor of IATPatchFunction is
   // not going to be any safer
   intercept_function_ = NULL;
   original_function_ = NULL;
   iat_thunk_ = NULL;
 
   return error;
 }
 
 }  // namespace iat_patch