Author: tfaber
Date: Wed Apr 19 12:21:57 2017
New Revision: 74375
URL: http://svn.reactos.org/svn/reactos?rev=74375&view=rev
Log:
[KMTESTS:OB]
- After ObCreateObject+ObInsertObject a handle close is enough to destroy the object, so do not dereference it in addition. Fixes use after free.
CORE-11474
Modified:
trunk/rostests/kmtests/ntos_ob/ObType.c
Modified: trunk/rostests/kmtests/ntos_ob/ObType.c
URL: http://svn.reactos.org/svn/reactos/trunk/rostests/kmtests/ntos_ob/ObType.c?…
==============================================================================
--- trunk/rostests/kmtests/ntos_ob/ObType.c [iso-8859-1] (original)
+++ trunk/rostests/kmtests/ntos_ob/ObType.c [iso-8859-1] Wed Apr 19 12:21:57 2017
@@ -341,9 +341,11 @@
if (!skip(ObBody[i] != NULL, "Nothing to dereference\n"))
{
if (ObHandle1[i]) CheckObject(ObHandle1[i], 3LU, 1LU);
+ Ret = ObReferenceObject(ObBody[i]);
+ if (ObHandle1[i]) CheckObject(ObHandle1[i], 4LU, 1LU);
Ret = ObDereferenceObject(ObBody[i]);
- ok_eq_longptr(Ret, (LONG_PTR)1);
- if (ObHandle1[i]) CheckObject(ObHandle1[i], 2LU, 1LU);
+ ok_eq_longptr(Ret, (LONG_PTR)2);
+ if (ObHandle1[i]) CheckObject(ObHandle1[i], 3LU, 1LU);
ObBody[i] = NULL;
}
if (!skip(ObHandle1[i] != NULL, "Nothing to close\n"))