Author: cgutman
Date: Tue Aug 12 15:03:53 2008
New Revision: 35292
URL:
http://svn.reactos.org/svn/reactos?rev=35292&view=rev
Log:
- Check for FCB->TdiDeviceName.Buffer before attempting to access it
- Fix 2 more memory leaks
Modified:
branches/aicom-network-fixes/drivers/network/afd/afd/main.c
Modified: branches/aicom-network-fixes/drivers/network/afd/afd/main.c
URL:
http://svn.reactos.org/svn/reactos/branches/aicom-network-fixes/drivers/net…
==============================================================================
--- branches/aicom-network-fixes/drivers/network/afd/afd/main.c [iso-8859-1] (original)
+++ branches/aicom-network-fixes/drivers/network/afd/afd/main.c [iso-8859-1] Tue Aug 12
15:03:53 2008
@@ -114,9 +114,6 @@
FCB->TdiDeviceName.MaximumLength = FCB->TdiDeviceName.Length;
FCB->TdiDeviceName.Buffer =
ExAllocatePool( NonPagedPool, FCB->TdiDeviceName.Length );
- RtlCopyMemory( FCB->TdiDeviceName.Buffer,
- ConnectInfo->TransportName,
- FCB->TdiDeviceName.Length );
if( !FCB->TdiDeviceName.Buffer ) {
ExFreePool(FCB);
@@ -125,6 +122,10 @@
IoCompleteRequest( Irp, IO_NETWORK_INCREMENT );
return STATUS_NO_MEMORY;
}
+
+ RtlCopyMemory( FCB->TdiDeviceName.Buffer,
+ ConnectInfo->TransportName,
+ FCB->TdiDeviceName.Length );
AFD_DbgPrint(MID_TRACE,("Success: %s %wZ\n",
EaInfo->EaName, &FCB->TdiDeviceName));
@@ -192,6 +193,9 @@
InFlightRequest[i]->InFlightRequest->IoStatus.Status = STATUS_CANCELLED;
InFlightRequest[i]->InFlightRequest->IoStatus.Information = 0;
IoCancelIrp( InFlightRequest[i]->InFlightRequest );
+ InFlightRequest[i]->InFlightRequest = NULL;
+ if( InFlightRequest[i]->ConnectionCallInfo ) ExFreePool(
InFlightRequest[i]->ConnectionCallInfo );
+ if( InFlightRequest[i]->ConnectionReturnInfo ) ExFreePool(
InFlightRequest[i]->ConnectionReturnInfo );
}
}