[ros-diffs] [pschweitzer] 76027: [KERNEL32] Avoid an use-after-free in GetVolumeNameForRoot()

Author: pschweitzer
Date: Sun Oct  1 21:29:53 2017
New Revision: 76027

URL: http://svn.reactos.org/svn/reactos?rev=76027&view=rev
Log:
[KERNEL32]
Avoid an use-after-free in GetVolumeNameForRoot()

Modified:
    trunk/reactos/dll/win32/kernel32/client/file/mntpoint.c

Modified: trunk/reactos/dll/win32/kernel32/client/file/mntpoint.c
URL: http://svn.reactos.org/svn/reactos/trunk/reactos/dll/win32/kernel32/client/f...
==============================================================================
--- trunk/reactos/dll/win32/kernel32/client/file/mntpoint.c	[iso-8859-1] (original)
+++ trunk/reactos/dll/win32/kernel32/client/file/mntpoint.c	[iso-8859-1] Sun Oct  1 21:29:53 2017
@@ -121,12 +121,12 @@
     MountPoint->DeviceNameOffset = sizeof(MOUNTMGR_MOUNT_POINT);
     MountPoint->DeviceNameLength = NtPathName.Length;
     RtlCopyMemory((PVOID)((ULONG_PTR)MountPoint + sizeof(MOUNTMGR_MOUNT_POINT)), NtPathName.Buffer, NtPathName.Length);
-    RtlFreeHeap(RtlGetProcessHeap(), 0, NtPathName.Buffer);

/* Allocate a dummy output buffer to probe for size */
     MountPoints = RtlAllocateHeap(RtlGetProcessHeap(), 0, sizeof(MOUNTMGR_MOUNT_POINTS));
     if (MountPoints == NULL)
     {
+        RtlFreeHeap(RtlGetProcessHeap(), 0, NtPathName.Buffer);
         RtlFreeHeap(RtlGetProcessHeap(), 0, MountPoint);
         SetLastError(ERROR_NOT_ENOUGH_MEMORY);
         return FALSE;
@@ -139,6 +139,7 @@
                                  INVALID_HANDLE_VALUE);
     if (MountMgrHandle == INVALID_HANDLE_VALUE)
     {
+        RtlFreeHeap(RtlGetProcessHeap(), 0, NtPathName.Buffer);
         RtlFreeHeap(RtlGetProcessHeap(), 0, MountPoints);
         RtlFreeHeap(RtlGetProcessHeap(), 0, MountPoint);
         return FALSE;
@@ -162,6 +163,7 @@
         if (MountPoints == NULL)
         {
             CloseHandle(MountMgrHandle);
+            RtlFreeHeap(RtlGetProcessHeap(), 0, NtPathName.Buffer);
             RtlFreeHeap(RtlGetProcessHeap(), 0, MountPoint);
             SetLastError(ERROR_NOT_ENOUGH_MEMORY);
             return FALSE;
@@ -181,6 +183,7 @@
     /* If the mount manager failed, just quit */
     if (!Ret)
     {
+        RtlFreeHeap(RtlGetProcessHeap(), 0, NtPathName.Buffer);
         RtlFreeHeap(RtlGetProcessHeap(), 0, MountPoints);
         SetLastError(ERROR_INVALID_PARAMETER);
         return FALSE;
@@ -218,6 +221,7 @@
     /* We couldn't find anything matching, return an error */
     if (CurrentMntPt == MountPoints->NumberOfMountPoints)
     {
+        RtlFreeHeap(RtlGetProcessHeap(), 0, NtPathName.Buffer);
         RtlFreeHeap(RtlGetProcessHeap(), 0, MountPoints);
         SetLastError(ERROR_INVALID_PARAMETER);
         return FALSE;
@@ -226,6 +230,7 @@
     /* We found a matching volume, have we enough memory to return it? */
     if (cchBufferLength * sizeof(WCHAR) < FoundVolumeLen + 2 * sizeof(WCHAR))
     {
+        RtlFreeHeap(RtlGetProcessHeap(), 0, NtPathName.Buffer);
         RtlFreeHeap(RtlGetProcessHeap(), 0, MountPoints);
         SetLastError(ERROR_FILENAME_EXCED_RANGE);
         return FALSE;
@@ -240,6 +245,7 @@
     lpszVolumeName[FoundVolumeLen / sizeof(WCHAR) + 1] = UNICODE_NULL;

/* We're done! */
+    RtlFreeHeap(RtlGetProcessHeap(), 0, NtPathName.Buffer);
     RtlFreeHeap(RtlGetProcessHeap(), 0, MountPoints);
     return TRUE;
 }