ExAllocatePoolWithTag should be paired with ExFreePoolWithTag

Fix a memory leak in W32kGetDefaultKeyLayout
Fix a possible double-free in IntFreeMenuItem

svn path=/trunk/; revision=35921
This commit is contained in:
Hervé Poussineau 2008-09-04 08:47:56 +00:00
parent a073152ea9
commit 7e71eef68b
7 changed files with 36 additions and 26 deletions

View file

@ -2,6 +2,7 @@
#define _WIN32K_TAGS_H
#define TAG_STRING TAG('S', 'T', 'R', ' ') /* string */
#define TAG_RTLREGISTRY TAG('R', 'q', 'r', 'v') /* RTL registry */
/* ntuser */
#define TAG_MOUSE TAG('M', 'O', 'U', 'S') /* mouse */
@ -87,6 +88,7 @@
#define TAG_DRIVER TAG('G', 'D', 'R', 'V') /* video drivers */
#define TAG_FNTFILE TAG('F', 'N', 'T', 'F') /* font file */
#define TAG_SSECTPOOL TAG('S', 'S', 'C', 'P') /* shared section pool */
#define TAG_PFF TAG('G', 'p', 'f', 'f') /* physical font file */
/* Dx internal tags rember I do not known if it right namees */
#define TAG_DXPVMLIST TAG('D', 'X', 'P', 'L') /* pmvlist for the driver */

View file

@ -355,7 +355,7 @@ IntParseDesktopPath(PEPROCESS Process,
NULL,
(HANDLE*)hWinSta);
RtlFreeUnicodeString(&FullName);
ExFreePoolWithTag(FullName.Buffer, TAG_STRING);
if(!NT_SUCCESS(Status))
{
@ -389,7 +389,7 @@ IntParseDesktopPath(PEPROCESS Process,
NULL,
(HANDLE*)hDesktop);
RtlFreeUnicodeString(&FullName);
ExFreePoolWithTag(FullName.Buffer, TAG_STRING);
if(!NT_SUCCESS(Status))
{
@ -931,11 +931,12 @@ NtUserCreateDesktop(
{
SetLastNtError(STATUS_INSUFFICIENT_RESOURCES);
ObDereferenceObject(WinStaObject);
if (lpszDesktopName)
RtlFreeUnicodeString(&SafeDesktopName);
if (lpszDesktopName)
ExFreePoolWithTag(SafeDesktopName.Buffer, TAG_STRING);
RETURN( NULL);
}
RtlFreeUnicodeString(&SafeDesktopName);
if (lpszDesktopName)
ExFreePoolWithTag(SafeDesktopName.Buffer, TAG_STRING);
ObDereferenceObject(WinStaObject);
/*
@ -963,7 +964,7 @@ NtUserCreateDesktop(
if (!NT_SUCCESS(Status)) RETURN(NULL);
if (Status == STATUS_OBJECT_NAME_EXISTS)
{
ExFreePool(DesktopName.Buffer);
ExFreePoolWithTag(DesktopName.Buffer, TAG_STRING);
RETURN( Desktop);
}
@ -1019,7 +1020,7 @@ NtUserCreateDesktop(
/* Initialize some local (to win32k) desktop state. */
DesktopObject->ActiveMessageQueue = NULL;
ExFreePool(DesktopName.Buffer);
ExFreePoolWithTag(DesktopName.Buffer, TAG_STRING);
if (! NT_SUCCESS(Status))
{
@ -1138,7 +1139,8 @@ NtUserOpenDesktop(
Result = IntGetFullWindowStationName(&DesktopName, &WinStaObject->Name,
&SafeDesktopName);
RtlFreeUnicodeString(&SafeDesktopName);
if (lpszDesktopName)
ExFreePoolWithTag(SafeDesktopName.Buffer, TAG_STRING);
ObDereferenceObject(WinStaObject);

View file

@ -92,7 +92,7 @@ static NTSTATUS NTAPI ReadRegistryValue( PUNICODE_STRING KeyName,
if( !NT_SUCCESS(Status) )
{
NtClose(KeyHandle);
ExFreePool(KeyValuePartialInfo);
ExFreePoolWithTag(KeyValuePartialInfo, TAG_STRING);
return Status;
}
@ -104,7 +104,7 @@ static NTSTATUS NTAPI ReadRegistryValue( PUNICODE_STRING KeyName,
if(!ReturnBuffer)
{
NtClose(KeyHandle);
ExFreePool(KeyValuePartialInfo);
ExFreePoolWithTag(KeyValuePartialInfo, TAG_STRING);
return STATUS_NO_MEMORY;
}
@ -113,7 +113,7 @@ static NTSTATUS NTAPI ReadRegistryValue( PUNICODE_STRING KeyName,
KeyValuePartialInfo->DataLength);
RtlInitUnicodeString(ReturnedValue, ReturnBuffer);
ExFreePool(KeyValuePartialInfo);
ExFreePoolWithTag(KeyValuePartialInfo, TAG_STRING);
NtClose(KeyHandle);
return Status;
@ -154,7 +154,7 @@ static BOOL UserLoadKbdDll(WCHAR *wsKLID,
FullLayoutPath.MaximumLength = sizeof(LayoutPathBuffer);
RtlAppendUnicodeStringToString(&FullLayoutPath, &LayoutFile);
DPRINT("Loading Keyboard DLL %wZ\n", &FullLayoutPath);
RtlFreeUnicodeString(&LayoutFile);
ExFreePoolWithTag(LayoutFile.Buffer, TAG_STRING);
*phModule = EngLoadImage(FullLayoutPath.Buffer);
@ -321,7 +321,10 @@ PKBL W32kGetDefaultKeyLayout(VOID)
Status = ReadRegistryValue(&FullKeyboardLayoutPath, &LayoutValueName, &LayoutLocaleIdString);
if( NT_SUCCESS(Status) )
{
RtlUnicodeStringToInteger(&LayoutLocaleIdString, 16, &LayoutLocaleId);
ExFreePoolWithTag(LayoutLocaleIdString.Buffer, TAG_STRING);
}
else
DPRINT1("ReadRegistryValue failed! (%08lx).\n", Status);
}

View file

@ -95,7 +95,7 @@ UserMenuInfo(
{ \
if((MENU_ITEM_TYPE((MenuItem)->fType) == MF_STRING) && \
(MenuItem)->Text.Length) { \
RtlFreeUnicodeString(&(MenuItem)->Text); \
ExFreePoolWithTag((MenuItem)->Text.Buffer, TAG_STRING); \
} \
}
@ -220,7 +220,6 @@ IntFreeMenuItem(PMENU_OBJECT Menu, PMENU_ITEM MenuItem, BOOL bRecurse)
}
/* Free memory */
if (MenuItem->Text.Buffer) ExFreePool(MenuItem->Text.Buffer);
ExFreePool(MenuItem);
return TRUE;

View file

@ -2259,7 +2259,7 @@ NtUserCreateWindowEx(DWORD dwExStyle,
{
if (! IS_ATOM(ClassName.Buffer))
{
RtlFreeUnicodeString(&ClassName);
ExFreePoolWithTag(ClassName.Buffer, TAG_STRING);
}
SetLastNtError(Status);
RETURN( NULL);
@ -2273,10 +2273,13 @@ NtUserCreateWindowEx(DWORD dwExStyle,
NewWindow = co_IntCreateWindowEx(dwExStyle, &ClassName, &WindowName, dwStyle, x, y, nWidth, nHeight,
hWndParent, hMenu, hInstance, lpParam, dwShowMode, bUnicodeWindow);
RtlFreeUnicodeString(&WindowName);
if (WindowName.Buffer)
{
ExFreePoolWithTag(WindowName.Buffer, TAG_STRING);
}
if (! IS_ATOM(ClassName.Buffer))
{
RtlFreeUnicodeString(&ClassName);
ExFreePoolWithTag(ClassName.Buffer, TAG_STRING);
}
RETURN( NewWindow);
@ -4013,7 +4016,7 @@ NtUserRegisterWindowMessage(PUNICODE_STRING MessageNameUnsafe)
Ret = (UINT)IntAddAtom(SafeMessageName.Buffer);
RtlFreeUnicodeString(&SafeMessageName);
ExFreePoolWithTag(SafeMessageName.Buffer, TAG_STRING);
RETURN( Ret);
CLEANUP:

View file

@ -216,7 +216,7 @@ FindDriverFileNames(PUNICODE_STRING DriverFileNames, ULONG DisplayNumber)
QueryTable,
NULL,
NULL);
RtlFreeUnicodeString(&RegistryPath);
ExFreePoolWithTag(RegistryPath.Buffer, TAG_RTLREGISTRY);
if (! NT_SUCCESS(Status))
{
DPRINT1("No InstalledDisplayDrivers value in service entry found\n");
@ -323,7 +323,7 @@ SetupDevMode(PDEVMODEW DevMode, ULONG DisplayNumber)
}
}
RtlFreeUnicodeString(&RegistryPath);
ExFreePoolWithTag(RegistryPath.Buffer, TAG_RTLREGISTRY);
if (! Valid)
{
@ -428,14 +428,14 @@ IntPrepareDriver()
if (!GotDriver)
{
ObDereferenceObject(PrimarySurface.VideoFileObject);
RtlFreeUnicodeString(&DriverFileNames);
ExFreePoolWithTag(DriverFileNames.Buffer, TAG_RTLREGISTRY);
DPRINT1("No suitable DDI driver found\n");
continue;
}
DPRINT("Display driver %S loaded\n", CurrentName);
RtlFreeUnicodeString(&DriverFileNames);
ExFreePoolWithTag(DriverFileNames.Buffer, TAG_RTLREGISTRY);
DPRINT("Building DDI Functions\n");
@ -2453,7 +2453,7 @@ DC_AllocDC(PUNICODE_STRING Driver)
{
if(Buf)
{
ExFreePool(Buf);
ExFreePoolWithTag(Buf, TAG_DC);
}
DPRINT1("GDIOBJ_AllocObjWithHandle failed\n");
return NULL;
@ -2644,7 +2644,8 @@ BOOL INTERNAL_CALL
DC_Cleanup(PVOID ObjectBody)
{
PDC pDC = (PDC)ObjectBody;
RtlFreeUnicodeString(&pDC->DriverName);
if (pDC->DriverName.Buffer)
ExFreePoolWithTag(pDC->DriverName.Buffer, TAG_DC);
return TRUE;
}
@ -3103,7 +3104,7 @@ IntEnumDisplaySettings(
}
}
RtlFreeUnicodeString(&DriverFileNames);
ExFreePoolWithTag(DriverFileNames.Buffer, TAG_RTLREGISTRY);
}
/* return cached info */

View file

@ -355,7 +355,7 @@ IntGdiAddFontResource(PUNICODE_STRING FileName, DWORD Characteristics)
return 0;
}
FontGDI->Filename = ExAllocatePool(PagedPool, FileName->Length + sizeof(WCHAR));
FontGDI->Filename = ExAllocatePoolWithTag(PagedPool, FileName->Length + sizeof(WCHAR), TAG_PFF);
if (FontGDI->Filename == NULL)
{
EngFreeMem(FontGDI);