[NTOS:FSRTL] Check for the correct return status when inserting a new Filter Context entry

According to our declaration/definition, IoChangeFileObjectFilerContext returns NTSTATUS, not BOOLEAN. Zero return (which was actually checked before) for BOOLEAN means failure, but for NTSTATUS it's success. So it should (and now actually does) free and fail appropriately only in failure case, but not in success, when it shouldn't.
This fixes most of problems with fltmgr.sys driver from Windows XP/Server 2003 and a lot of 3rd party filter drivers which use it from many apps (Avast Free Antivirus all versions, Avira AntiVir Personal 8.2, Dr. Web Security Space 8.0, Kaspersky Antivirus 2012 etc. etc.).
CORE-14157, CORE-14635, CORE-19318
This commit is contained in:
Oleg Dubinskiy 2024-08-26 11:16:49 +02:00
parent c948ea859b
commit c59e2d20d9

View file

@ -176,6 +176,7 @@ FsRtlInsertPerFileObjectContext(IN PFILE_OBJECT FileObject,
IN PFSRTL_PER_FILEOBJECT_CONTEXT Ptr)
{
PFILE_OBJECT_FILTER_CONTEXTS FOContext = NULL;
NTSTATUS Status;
if (!FileObject)
{
@ -203,7 +204,8 @@ FsRtlInsertPerFileObjectContext(IN PFILE_OBJECT FileObject,
InitializeListHead(&(FOContext->FilterContexts));
/* Set it */
if (!IoChangeFileObjectFilterContext(FileObject, FOContext, TRUE))
Status = IoChangeFileObjectFilterContext(FileObject, FOContext, TRUE);
if (!NT_SUCCESS(Status))
{
/* If it fails, it means that someone else has set it in the meanwhile */
ExFreePoolWithTag(FOContext, 'FOCX');