| Previous | Next |
| STATUS_FAILED_STACK_SWITCH | STATUS_SMARTCARD_WRONG_PIN |
STATUS_HEAP_CORRUPTION
Meaning and context of STATUS_HEAP_CORRUPTION
This error occurs when trying to allocate memory in a heap in which a corruption of the internal structure is detected. Usually the reason for this is that the program code previously allocated a block of memory and wrote more data into it than it requested when allocating. It is also possible that the size of the previously allocated block is zero. This is possible if the program does not always check the return results of internal or api functions.
Most applications allocate smaller blocks than the 64-KB minimum allocation granularity possible using page granularity functions such as VirtualAlloc and VirtualAllocExNuma. Allocating such a large area for relatively small allocations is not optimal from a memory usage and performance standpoint. To address this need, Windows provides a component called the heap manager, which manages allocations inside larger memory areas reserved using the page granularity memory allocation functions. The allocation granularity in the heap manager is relatively small: 8 bytes on 32-bit systems, and 16 bytes on 64-bit systems. The heap manager has been designed to optimize memory usage and performance in the case of these smaller allocations.
The heap manager exists in two places: Ntdll.dll and Ntoskrnl.exe. The subsystem APIs (such as the Windows heap APIs) call the functions in Ntdll, and various executive components and device drivers call the functions in Ntoskrnl. Its native interfaces (prefixed with Rtl) are available only for use in internal Windows components or kernel-mode device drivers. The documented Windows API interfaces to the heap (prefixed with Heap) are forwarders to the native functions in Ntdll.dll. In addition, legacy APIs (prefixed with either Local or Global) are provided to support older Windows applications, which also internally call the heap manager, using some of its specialized interfaces to support legacy behavior. The C runtime (CRT) also uses the heap manager when using functions such as malloc, free, and the C++ new operator. The most common Windows heap functions are:
- HeapCreate or HeapDestroy Creates or deletes, respectively, a heap. The initial reserved and committed size can be specified at creation.
- HeapAlloc Allocates a heap block.
Native status interpretation
STATUS_HEAP_CORRUPTION is 0xC0000374, an NTSTATUS error value. AllStat describes it as “A heap has been corrupted.”. The first useful question is which native API, IRP, protocol operation, or subsystem in the kernel, native API, or subsystem that returned the status produced that status.
Debugging sequence
- Preserve this result before RtlNtStatusToDosError, HRESULT conversion, exception translation, or provider-specific remapping removes information.
- Log the operation associated with heap / corruption, the object or handle type, process and thread identity, and the state transition immediately before the return.
- When user mode receives this result, capture both the native status and the final Win32/COM error so the translation boundary remains visible.
Recovery considerations
A retry is appropriate only after the owner of this result has changed the state described by “A heap has been corrupted.”, or when its contract explicitly marks the status as transient. If the value reports corruption, invalid format, access policy, or a lifecycle mismatch, preserve evidence and correct that cause before repeating the request.
Official references
Looking for a different code? Search another status or error code.