[ros-diffs] [janderwald] 39956: - Check if handle is re-used. Fixes double-freeing of handle & crash

Author: janderwald
Date: Wed Mar 11 21:32:32 2009
New Revision: 39956
URL: http://svn.reactos.org/svn/reactos?rev=39956&view=rev
Log:
- Check if handle is re-used. Fixes double-freeing of handle & crash
Modified:
    trunk/reactos/drivers/wdm/audio/legacy/wdmaud/control.c
Modified: trunk/reactos/drivers/wdm/audio/legacy/wdmaud/control.c
URL:
http://svn.reactos.org/svn/reactos/trunk/reactos/drivers/wdm/audio/legacy/w…
==============================================================================
--- trunk/reactos/drivers/wdm/audio/legacy/wdmaud/control.c [iso-8859-1] (original)
+++ trunk/reactos/drivers/wdm/audio/legacy/wdmaud/control.c [iso-8859-1] Wed Mar 11
21:32:32 2009
@@ -137,7 +137,7 @@
     ACCESS_MASK DesiredAccess = 0;
     HANDLE PinHandle;
     KSPIN_CONNECT * PinConnect;
-    ULONG Length;
+    ULONG Length, Index;
     KSDATAFORMAT_WAVEFORMATEX * DataFormat;
     ULONG FilterId;
     ULONG PinId;
@@ -235,7 +235,20 @@
     Status = KsSynchronousIoControlDevice(ClientInfo->FileObject, KernelMode,
IOCTL_KS_PROPERTY, (PVOID)InstanceInfo, Length, &PinHandle, sizeof(HANDLE),
&BytesReturned);
     if (NT_SUCCESS(Status))
     {
-        PHANDLE Handels = ExAllocatePool(NonPagedPool, sizeof(HANDLE) *
(ClientInfo->NumPins+1));
+        PHANDLE Handels;
+
+        for(Index = 0; Index < ClientInfo->NumPins; Index++)
+        {
+            if (ClientInfo->hPins[Index] == PinHandle)
+            {
+                /* the pin handle has been re-used */
+                DeviceInfo->hDevice = PinHandle;
+                return SetIrpIoStatus(Irp, Status, sizeof(WDMAUD_DEVICE_INFO));
+            }
+
+        }
+
+        Handels = ExAllocatePool(NonPagedPool, sizeof(HANDLE) *
(ClientInfo->NumPins+1));
         if (Handels)
         {