Intravision/reactos
1
0
Fork 0
mirror of https://github.com/reactos/reactos.git synced 2024-06-30 09:50:07 +00:00
Code Issues Packages Projects Releases Wiki Activity

[NTOS:IO][NTOS:PNP] Fix incorrect usage of IopGetRegistryValue

Browse source 
KEY_VALUE_FULL_INFORMATION was not always freed properly
This commit is contained in:
Victor Perevertkin 2021-03-19 01:07:22 +03:00
parent 42094071ee
commit aec3d9cc8f
No known key found for this signature in database
GPG key ID: C750B7222E9C7830
2 changed files with 55 additions and 42 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
ntoskrnl/io/iomgr/driver.c
View file

@ -195,7 +195,12 @@ IopGetDriverNames(
if (driverName.Buffer == NULL)
{
status = IopGetRegistryValue(ServiceHandle, L"Type", &kvInfo);
if (!NT_SUCCESS(status) || kvInfo->Type != REG_DWORD)
if (!NT_SUCCESS(status))
{
ExFreePoolWithTag(basicInfo, TAG_IO);
return status;
}
if (kvInfo->Type != REG_DWORD)
{
ExFreePool(kvInfo);
ExFreePoolWithTag(basicInfo, TAG_IO); // container for serviceName

12
ntoskrnl/io/pnpmgr/devaction.c
View file

@ -419,11 +419,15 @@ PiAttachFilterDriversCallback(
SERVICE_LOAD_TYPE startType = DisableLoad;
Status = IopGetRegistryValue(serviceHandle, L"Start", &kvInfo);
if (NT_SUCCESS(Status) && kvInfo->Type == REG_DWORD)
if (NT_SUCCESS(Status))
{
if (kvInfo->Type == REG_DWORD)
{
RtlMoveMemory(&startType,
(PVOID)((ULONG_PTR)kvInfo + kvInfo->DataOffset),
sizeof(startType));
}
ExFreePool(kvInfo);
}
@ -621,7 +625,9 @@ PiCallDriverAddDevice(
// try to get the class GUID of an instance and its registry key
Status = IopGetRegistryValue(SubKey, REGSTR_VAL_CLASSGUID, &kvInfo);
if (NT_SUCCESS(Status) && kvInfo->Type == REG_SZ && kvInfo->DataLength > sizeof(WCHAR))
if (NT_SUCCESS(Status))
{
if (kvInfo->Type == REG_SZ && kvInfo->DataLength > sizeof(WCHAR))
{
UNICODE_STRING classGUID = {
.MaximumLength = kvInfo->DataLength,
@ -667,6 +673,8 @@ PiCallDriverAddDevice(
ZwClose(propertiesHandle);
}
}
}
ExFreePool(kvInfo);
}