3) ntdll!RtlGetProcessHeaps()

Hume(冷雨飘心)果然对SEH了解深入，以前我一直没有关注过__finally块，直到看见
Hume所给的RtlGetProcessHeaps()伪代码，奇怪Hume凭什么认为这里是__finally块，
而不是__except块，仔细研究了一番，佩服Hume!

原C风格的伪代码基本正确，但在表述__finally块范围时有误，另一处是返回值表述
有误，我修正如下，算是狗尾续貂:

--------------------------------------------------------------------------
/*
 * Create: Hume 2003-11-07 17:29
 * Modify: scz  2003-11-10 13:51
 *              2003-12-01 11:09
 *
 * ntdll.dll中定义的全局变量
 */
extern unsigned char        RtlpDebugPageHeap;
extern RTL_CRITICAL_SECTION RtlpProcessHeapsListLock;

DWORD __stdcall RtlGetProcessHeaps
(
    DWORD   NumberOfHeaps,  // maximum number of heap handles
    PHANDLE ProcessHeaps    // buffer for heap handles
)
{
    DWORD   PebNumberOfHeaps;
    DWORD   LocalNumberOfHeaps;
    PTEB    Teb = NtCurrentTeb();
    DWORD   ret;

    RtlEnterCriticalSection( &RtlpProcessHeapsListLock );
    __try
    {
        PebNumberOfHeaps    = Teb->Peb->NumberOfHeaps;
        if ( Teb->Peb->NumberOfHeaps > NumberOfHeaps )
        {
            LocalNumberOfHeaps  = NumberOfHeaps;
        }
        else
        {
            LocalNumberOfHeaps  = Teb->Peb->NumberOfHeaps;
        }
        /*
         * 这条语句可能引发异常，需要SEH机制的保护
         */
        CopyMemory
        (
            ProcessHeaps,
            Teb->Peb->ProcessHeaps,
            LocalNumberOfHeaps * sizeof( HANDLE )
        );
        /*
         * 修正形参，为处理调试堆做准备
         */
        ProcessHeaps       += LocalNumberOfHeaps * sizeof( HANDLE );
        NumberOfHeaps      -= LocalNumberOfHeaps;
    }
    __finally
    {
        ret                 = PebNumberOfHeaps;
        RtlLeaveCriticalSection( &RtlpProcessHeapsListLock );
    }
    /*
     * 注意，后续代码不受本函数中的SEH机制保护，并且已经离开临界区。
     * RtlpDebugPageHeapGetProcessHeaps()有自己的SEH机制提供保护。
     */
    if ( RtlpDebugPageHeap )
    {
        ret += RtlpDebugPageHeapGetProcessHeaps
               (
                   NumberOfHeaps,
                   ProcessHeaps
               );
    }
    /*
     * The return value is the number of heap handles that are valid for
     * the calling process.
     *
     * 注意，这个返回值不是当前获取的堆句柄数，而是整个进程中有效堆句柄数。
     */
    return( ret );
}  /* end of RtlGetProcessHeaps */
--------------------------------------------------------------------------