Intravision/reactos
1
0
Fork 0
mirror of https://github.com/reactos/reactos.git synced 2025-05-13 06:18:17 +00:00
Code Issues Projects Releases Packages Wiki Activity

[KMTESTS:OB]

Browse source 
- After ObCreateObject+ObInsertObject a handle close is enough to destroy the object, so do not dereference it in addition. Fixes use after free.
CORE-11474

svn path=/trunk/; revision=74375
This commit is contained in:
Thomas Faber 2017-04-19 12:21:57 +00:00
parent eff26a3a92
commit 424bbf064b
1 changed files with 4 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
rostests/kmtests/ntos_ob/ObType.c
View file

@ -341,9 +341,11 @@ ObtClose(
if (!skip(ObBody[i] != NULL, "Nothing to dereference\n")) if (!skip(ObBody[i] != NULL, "Nothing to dereference\n"))
{ {
if (ObHandle1[i]) CheckObject(ObHandle1[i], 3LU, 1LU); if (ObHandle1[i]) CheckObject(ObHandle1[i], 3LU, 1LU);
Ret = ObReferenceObject(ObBody[i]);
if (ObHandle1[i]) CheckObject(ObHandle1[i], 4LU, 1LU);
Ret = ObDereferenceObject(ObBody[i]); Ret = ObDereferenceObject(ObBody[i]);
ok_eq_longptr(Ret, (LONG_PTR)1); ok_eq_longptr(Ret, (LONG_PTR)2);
if (ObHandle1[i]) CheckObject(ObHandle1[i], 2LU, 1LU); if (ObHandle1[i]) CheckObject(ObHandle1[i], 3LU, 1LU);
ObBody[i] = NULL; ObBody[i] = NULL;
} }
if (!skip(ObHandle1[i] != NULL, "Nothing to close\n")) if (!skip(ObHandle1[i] != NULL, "Nothing to close\n"))