Intravision/reactos
1
0
Fork 0
mirror of https://github.com/reactos/reactos.git synced 2024-07-03 19:24:20 +00:00
Code Issues Packages Projects Releases Wiki Activity

- Check if handle is re-used. Fixes double-freeing of handle & crash

Browse source 
svn path=/trunk/; revision=39956
This commit is contained in:
Johannes Anderwald 2009-03-11 18:32:32 +00:00
parent da9027ac4f
commit 6d0e4470e0
1 changed files with 15 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

17
reactos/drivers/wdm/audio/legacy/wdmaud/control.c
View file

@ -137,7 +137,7 @@ WdmAudControlOpen(
ACCESS_MASK DesiredAccess = 0;
HANDLE PinHandle;
KSPIN_CONNECT * PinConnect;
ULONG Length;
ULONG Length, Index;
KSDATAFORMAT_WAVEFORMATEX * DataFormat;
ULONG FilterId;
ULONG PinId;
@ -235,7 +235,20 @@ WdmAudControlOpen(
Status = KsSynchronousIoControlDevice(ClientInfo->FileObject, KernelMode, IOCTL_KS_PROPERTY, (PVOID)InstanceInfo, Length, &PinHandle, sizeof(HANDLE), &BytesReturned);
if (NT_SUCCESS(Status))
{
PHANDLE Handels = ExAllocatePool(NonPagedPool, sizeof(HANDLE) * (ClientInfo->NumPins+1));
PHANDLE Handels;
for(Index = 0; Index < ClientInfo->NumPins; Index++)
{
if (ClientInfo->hPins[Index] == PinHandle)
{
/* the pin handle has been re-used */
DeviceInfo->hDevice = PinHandle;
return SetIrpIoStatus(Irp, Status, sizeof(WDMAUD_DEVICE_INFO));
}
}
Handels = ExAllocatePool(NonPagedPool, sizeof(HANDLE) * (ClientInfo->NumPins+1));
if (Handels)
{