Don't unpatch an unloaded module. We verify if the original function address ...

base/iat_patch.cc

Index: base/iat_patch.cc
===================================================================
--- base/iat_patch.cc	(revision 9881)
+++ base/iat_patch.cc	(working copy)
@@ -205,9 +205,25 @@
 }
 
 DWORD IATPatchFunction::Unpatch() {
-  DWORD error = RestoreImportedFunction(intercept_function_,
-                                        original_function_,
-                                        iat_thunk_);
+  DWORD error = 0;  
+  MEMORY_BASIC_INFORMATION memory_info = {0};
+
+  // If the module has already unloaded, no point trying to unpatch.
+  if (!VirtualQuery(original_function_, &memory_info,
+                    sizeof(memory_info))) {
+    error = GetLastError();
+    NOTREACHED();
+    return error;
+  }

[Dean McNamee, 2009/02/18 11:35:38]

Shouldn't you set all of the functions to NULL here?

+
+  if ((memory_info.State  & MEM_COMMIT) != MEM_COMMIT) {
+    NOTREACHED();
+    return ERROR_ACCESS_DENIED;
+  }
+
+  error = RestoreImportedFunction(intercept_function_,
+                                  original_function_,
+                                  iat_thunk_);
   DCHECK(NO_ERROR == error);
 
   // Hands off the intercept if we fail to unpatch.