[ros-diffs] [tfaber] 74375: [KMTESTS:OB] - After ObCreateObject+ObInsertObject a handle close is enough to destroy the object, so do not dereference it in addition. Fixes use after free. CORE-11474

Author: tfaber
Date: Wed Apr 19 12:21:57 2017
New Revision: 74375

URL: http://svn.reactos.org/svn/reactos?rev=74375&view=rev
Log:
[KMTESTS:OB]
- After ObCreateObject+ObInsertObject a handle close is enough to destroy the object, so do not dereference it in addition. Fixes use after free.
CORE-11474

Modified:
    trunk/rostests/kmtests/ntos_ob/ObType.c

Modified: trunk/rostests/kmtests/ntos_ob/ObType.c
URL: http://svn.reactos.org/svn/reactos/trunk/rostests/kmtests/ntos_ob/ObType.c?r...
==============================================================================
--- trunk/rostests/kmtests/ntos_ob/ObType.c	[iso-8859-1] (original)
+++ trunk/rostests/kmtests/ntos_ob/ObType.c	[iso-8859-1] Wed Apr 19 12:21:57 2017
@@ -341,9 +341,11 @@
         if (!skip(ObBody[i] != NULL, "Nothing to dereference\n"))
         {
             if (ObHandle1[i]) CheckObject(ObHandle1[i], 3LU, 1LU);
+            Ret = ObReferenceObject(ObBody[i]);
+            if (ObHandle1[i]) CheckObject(ObHandle1[i], 4LU, 1LU);
             Ret = ObDereferenceObject(ObBody[i]);
-            ok_eq_longptr(Ret, (LONG_PTR)1);
-            if (ObHandle1[i]) CheckObject(ObHandle1[i], 2LU, 1LU);
+            ok_eq_longptr(Ret, (LONG_PTR)2);
+            if (ObHandle1[i]) CheckObject(ObHandle1[i], 3LU, 1LU);
             ObBody[i] = NULL;
         }
         if (!skip(ObHandle1[i] != NULL, "Nothing to close\n"))