Intravision/reactos
1
0
Fork 0
mirror of https://github.com/reactos/reactos.git synced 2024-09-28 05:26:58 +00:00
Code Issues Packages Projects Releases Wiki Activity

[KERNEL32]

Browse source 
Avoid an use-after-free in GetVolumeNameForRoot()

svn path=/trunk/; revision=76027
This commit is contained in:
Pierre Schweitzer 2017-10-01 21:29:53 +00:00
parent bed6d00963
commit 9c82138c3c
1 changed files with 7 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
reactos/dll/win32/kernel32/client/file/mntpoint.c
View file

@ -121,12 +121,12 @@ GetVolumeNameForRoot(IN LPCWSTR lpszRootPath,
MountPoint->DeviceNameOffset = sizeof(MOUNTMGR_MOUNT_POINT);
MountPoint->DeviceNameLength = NtPathName.Length;
RtlCopyMemory((PVOID)((ULONG_PTR)MountPoint + sizeof(MOUNTMGR_MOUNT_POINT)), NtPathName.Buffer, NtPathName.Length);
RtlFreeHeap(RtlGetProcessHeap(), 0, NtPathName.Buffer);
/* Allocate a dummy output buffer to probe for size */
MountPoints = RtlAllocateHeap(RtlGetProcessHeap(), 0, sizeof(MOUNTMGR_MOUNT_POINTS));
if (MountPoints == NULL)
{
RtlFreeHeap(RtlGetProcessHeap(), 0, NtPathName.Buffer);
RtlFreeHeap(RtlGetProcessHeap(), 0, MountPoint);
SetLastError(ERROR_NOT_ENOUGH_MEMORY);
return FALSE;
@ -139,6 +139,7 @@ GetVolumeNameForRoot(IN LPCWSTR lpszRootPath,
INVALID_HANDLE_VALUE);
if (MountMgrHandle == INVALID_HANDLE_VALUE)
{
RtlFreeHeap(RtlGetProcessHeap(), 0, NtPathName.Buffer);
RtlFreeHeap(RtlGetProcessHeap(), 0, MountPoints);
RtlFreeHeap(RtlGetProcessHeap(), 0, MountPoint);
return FALSE;
@ -162,6 +163,7 @@ GetVolumeNameForRoot(IN LPCWSTR lpszRootPath,
if (MountPoints == NULL)
{
CloseHandle(MountMgrHandle);
RtlFreeHeap(RtlGetProcessHeap(), 0, NtPathName.Buffer);
RtlFreeHeap(RtlGetProcessHeap(), 0, MountPoint);
SetLastError(ERROR_NOT_ENOUGH_MEMORY);
return FALSE;
@ -181,6 +183,7 @@ GetVolumeNameForRoot(IN LPCWSTR lpszRootPath,
/* If the mount manager failed, just quit */
if (!Ret)
{
RtlFreeHeap(RtlGetProcessHeap(), 0, NtPathName.Buffer);
RtlFreeHeap(RtlGetProcessHeap(), 0, MountPoints);
SetLastError(ERROR_INVALID_PARAMETER);
return FALSE;
@ -218,6 +221,7 @@ GetVolumeNameForRoot(IN LPCWSTR lpszRootPath,
/* We couldn't find anything matching, return an error */
if (CurrentMntPt == MountPoints->NumberOfMountPoints)
{
RtlFreeHeap(RtlGetProcessHeap(), 0, NtPathName.Buffer);
RtlFreeHeap(RtlGetProcessHeap(), 0, MountPoints);
SetLastError(ERROR_INVALID_PARAMETER);
return FALSE;
@ -226,6 +230,7 @@ GetVolumeNameForRoot(IN LPCWSTR lpszRootPath,
/* We found a matching volume, have we enough memory to return it? */
if (cchBufferLength * sizeof(WCHAR) < FoundVolumeLen + 2 * sizeof(WCHAR))
{
RtlFreeHeap(RtlGetProcessHeap(), 0, NtPathName.Buffer);
RtlFreeHeap(RtlGetProcessHeap(), 0, MountPoints);
SetLastError(ERROR_FILENAME_EXCED_RANGE);
return FALSE;
@ -240,6 +245,7 @@ GetVolumeNameForRoot(IN LPCWSTR lpszRootPath,
lpszVolumeName[FoundVolumeLen / sizeof(WCHAR) + 1] = UNICODE_NULL;
/* We're done! */
RtlFreeHeap(RtlGetProcessHeap(), 0, NtPathName.Buffer);
RtlFreeHeap(RtlGetProcessHeap(), 0, MountPoints);
return TRUE;
}