Intravision/reactos
1
0
Fork 0
mirror of https://github.com/reactos/reactos.git synced 2025-06-01 15:38:37 +00:00
Code Issues Projects Releases Packages Wiki Activity

[NTOS:IO] Fix driverName.Buffer leak in some failure paths in IopGetDriverNames().

Browse source 
driverName.Buffer leaked when the "(!NT_SUCCESS(status) || ServiceName != NULL)"
case is taken because ServiceName != NULL, and some of the functions fail.
This commit is contained in:
Hermès Bélusca-Maïto 2021-06-10 23:11:27 +02:00
parent e09d1dec7a
commit 32a82eb123
No known key found for this signature in database
GPG key ID: 3B2539C65E7B93D0
1 changed files with 8 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

13
ntoskrnl/io/iomgr/driver.c
View file

@ -171,21 +171,22 @@ IopGetDriverNames(
status = ZwQueryKey(ServiceHandle, KeyBasicInformation, NULL, 0, &infoLength);
if (status != STATUS_BUFFER_TOO_SMALL)
{
return NT_SUCCESS(status) ? STATUS_UNSUCCESSFUL : status;
status = (NT_SUCCESS(status) ? STATUS_UNSUCCESSFUL : status);
goto Cleanup;
}
/* Allocate the buffer and retrieve the data */
basicInfo = ExAllocatePoolWithTag(PagedPool, infoLength, TAG_IO);
if (!basicInfo)
{
return STATUS_INSUFFICIENT_RESOURCES;
status = STATUS_INSUFFICIENT_RESOURCES;
goto Cleanup;
}
status = ZwQueryKey(ServiceHandle, KeyBasicInformation, basicInfo, infoLength, &infoLength);
if (!NT_SUCCESS(status))
{
ExFreePoolWithTag(basicInfo, TAG_IO);
return status;
goto Cleanup;
}
serviceName.Length = basicInfo->NameLength;
@ -248,7 +249,6 @@ IopGetDriverNames(
PWCHAR buf = ExAllocatePoolWithTag(PagedPool, serviceName.Length, TAG_IO);
if (!buf)
{
ExFreePoolWithTag(driverName.Buffer, TAG_IO);
status = STATUS_INSUFFICIENT_RESOURCES;
goto Cleanup;
}
@ -265,6 +265,9 @@ Cleanup:
if (basicInfo)
ExFreePoolWithTag(basicInfo, TAG_IO);
if (!NT_SUCCESS(status) && driverName.Buffer)
ExFreePoolWithTag(driverName.Buffer, TAG_IO);
return status;
}