[ros-diffs] [weiden] 17217: revert my last changes back to Alex's version of ObpCaptureObjectAttributes as I'm being an incompetent ass. This will introduce several vulnerabilities and bugs again.

revert my last changes back to Alex's version of
ObpCaptureObjectAttributes as I'm being an incompetent ass. This will
introduce several vulnerabilities and bugs again.
Modified: trunk/reactos/ntoskrnl/cm/ntfunc.c
Modified: trunk/reactos/ntoskrnl/cm/registry.c
Modified: trunk/reactos/ntoskrnl/include/internal/ob.h
Modified: trunk/reactos/ntoskrnl/lpc/connect.c
Modified: trunk/reactos/ntoskrnl/ob/handle.c
Modified: trunk/reactos/ntoskrnl/ob/namespc.c
Modified: trunk/reactos/ntoskrnl/ob/object.c
  _____  

Modified: trunk/reactos/ntoskrnl/cm/ntfunc.c
--- trunk/reactos/ntoskrnl/cm/ntfunc.c	2005-08-08 16:57:50 UTC (rev
17216)
+++ trunk/reactos/ntoskrnl/cm/ntfunc.c	2005-08-08 16:58:30 UTC (rev
17217)
@@ -192,19 +192,20 @@

   PWSTR Start;
   UNICODE_STRING ObjectName;
   OBJECT_CREATE_INFORMATION ObjectCreateInfo;
-  KPROCESSOR_MODE PreviousMode;
   unsigned i;
 
   PAGED_CODE();
-  
-  PreviousMode = KeGetPreviousMode();
 
+  DPRINT("NtCreateKey (Name %wZ  KeyHandle 0x%p  Root 0x%p)\n",
+	 ObjectAttributes->ObjectName,
+	 KeyHandle,
+	 ObjectAttributes->RootDirectory);
+
    /* Capture all the info */
    DPRINT("Capturing Create Info\n");
    Status = ObpCaptureObjectAttributes(ObjectAttributes,
-                                       PreviousMode,
-                                       PagedPool,
-                                       FALSE,
+                                       KeGetPreviousMode(),
+                                       CmiKeyType,
                                        &ObjectCreateInfo,
                                        &ObjectName);
    if (!NT_SUCCESS(Status))
@@ -218,10 +219,8 @@
 			            (PVOID*)&Object,
                         &RemainingPath,
                         CmiKeyType);
-     ObpReleaseCapturedAttributes(&ObjectCreateInfo,
-                                  &ObjectName,
-                                  PreviousMode,
-                                  FALSE);
+     ObpReleaseCapturedAttributes(&ObjectCreateInfo);
+   if (ObjectName.Buffer) ExFreePool(ObjectName.Buffer);
   if (!NT_SUCCESS(Status))
     {
       DPRINT("CmpFindObject failed, Status: 0x%x\n", Status);
@@ -1170,8 +1169,7 @@
    DPRINT("Capturing Create Info\n");
    Status = ObpCaptureObjectAttributes(ObjectAttributes,
                                        PreviousMode,
-                                       PagedPool,
-                                       FALSE,
+                                       CmiKeyType,
                                        &ObjectCreateInfo,
                                        &ObjectName);
    if (!NT_SUCCESS(Status))
@@ -1187,10 +1185,8 @@
 			            (PVOID*)&Object,
                         &RemainingPath,
                         CmiKeyType);
-     ObpReleaseCapturedAttributes(&ObjectCreateInfo,
-                                  &ObjectName,
-                                  PreviousMode,
-                                  FALSE);
+     ObpReleaseCapturedAttributes(&ObjectCreateInfo);
+   if (ObjectName.Buffer) ExFreePool(ObjectName.Buffer);
   if (!NT_SUCCESS(Status))
     {
       DPRINT("CmpFindObject() returned 0x%08lx\n", Status);
  _____  

Modified: trunk/reactos/ntoskrnl/cm/registry.c
--- trunk/reactos/ntoskrnl/cm/registry.c	2005-08-08 16:57:50 UTC
(rev 17216)
+++ trunk/reactos/ntoskrnl/cm/registry.c	2005-08-08 16:58:30 UTC
(rev 17217)
@@ -705,8 +705,7 @@

    DPRINT("Capturing Create Info\n");
    Status = ObpCaptureObjectAttributes(KeyObjectAttributes,
                                        KernelMode,
-                                       PagedPool,
-                                       FALSE,
+                                       CmiKeyType,
                                        &ObjectCreateInfo,
                                        &ObjectName);
    if (!NT_SUCCESS(Status))
@@ -720,10 +719,8 @@
 			            (PVOID*)&ParentKey,
                         &RemainingPath,
                         CmiKeyType);
-     ObpReleaseCapturedAttributes(&ObjectCreateInfo,
-                                  &ObjectName,
-                                  KernelMode,
-                                  FALSE);
+     ObpReleaseCapturedAttributes(&ObjectCreateInfo);
+   if (ObjectName.Buffer) ExFreePool(ObjectName.Buffer);
   if (!NT_SUCCESS(Status))
     {
       return Status;
  _____  

Modified: trunk/reactos/ntoskrnl/include/internal/ob.h
--- trunk/reactos/ntoskrnl/include/internal/ob.h	2005-08-08
16:57:50 UTC (rev 17216)
+++ trunk/reactos/ntoskrnl/include/internal/ob.h	2005-08-08
16:58:30 UTC (rev 17217)
@@ -173,6 +173,14 @@

 
 /* Secure object information functions */
 
+typedef struct _CAPTURED_OBJECT_ATTRIBUTES
+{
+  HANDLE RootDirectory;
+  ULONG Attributes;
+  PSECURITY_DESCRIPTOR SecurityDescriptor;
+  PSECURITY_QUALITY_OF_SERVICE SecurityQualityOfService;
+} CAPTURED_OBJECT_ATTRIBUTES, *PCAPTURED_OBJECT_ATTRIBUTES;
+
 NTSTATUS
 STDCALL
 ObpCaptureObjectName(IN PUNICODE_STRING CapturedName,
@@ -181,19 +189,16 @@
                      
 NTSTATUS
 STDCALL
-ObpCaptureObjectAttributes(IN POBJECT_ATTRIBUTES ObjectAttributes
OPTIONAL,
+ObpCaptureObjectAttributes(IN POBJECT_ATTRIBUTES ObjectAttributes,
                            IN KPROCESSOR_MODE AccessMode,
-                           IN POOL_TYPE PoolType,
-                           IN BOOLEAN CaptureIfKernel,
-                           OUT POBJECT_CREATE_INFORMATION
CapturedObjectAttributes  OPTIONAL,
-                           OUT PUNICODE_STRING ObjectName  OPTIONAL);
+                           IN POBJECT_TYPE ObjectType,
+                           IN POBJECT_CREATE_INFORMATION
ObjectCreateInfo,
+                           OUT PUNICODE_STRING ObjectName);
 
 VOID
 STDCALL
-ObpReleaseCapturedAttributes(IN POBJECT_CREATE_INFORMATION
CapturedObjectAttributes  OPTIONAL,
-                             IN PUNICODE_STRING ObjectName  OPTIONAL,
-                             IN KPROCESSOR_MODE AccessMode,
-                             IN BOOLEAN CaptureIfKernel);
+ObpReleaseCapturedAttributes(IN POBJECT_CREATE_INFORMATION
ObjectCreateInfo);
+
 /* object information classes */
 
 #define ICIF_QUERY               0x1
  _____  

Modified: trunk/reactos/ntoskrnl/lpc/connect.c
--- trunk/reactos/ntoskrnl/lpc/connect.c	2005-08-08 16:57:50 UTC
(rev 17216)
+++ trunk/reactos/ntoskrnl/lpc/connect.c	2005-08-08 16:58:30 UTC
(rev 17217)
@@ -410,7 +410,7 @@

                                     NULL,
                                     PORT_ALL_ACCESS,  /* DesiredAccess
*/
                                     LpcPortObjectType,
-                                    PreviousMode,
+                                    UserMode,
                                     NULL,
                                     (PVOID*)&NamedPort);
   if (!NT_SUCCESS(Status))
@@ -430,7 +430,7 @@
       Status = ObReferenceObjectByHandle(WriteMap.SectionHandle,
 					 SECTION_MAP_READ |
SECTION_MAP_WRITE,
 					 MmSectionObjectType,
-					 PreviousMode,
+					 UserMode,
 					 (PVOID*)&SectionObject,
 					 NULL);
       if (!NT_SUCCESS(Status))
  _____  

Modified: trunk/reactos/ntoskrnl/ob/handle.c
--- trunk/reactos/ntoskrnl/ob/handle.c	2005-08-08 16:57:50 UTC (rev
17216)
+++ trunk/reactos/ntoskrnl/ob/handle.c	2005-08-08 16:58:30 UTC (rev
17217)
@@ -955,7 +955,7 @@

     /* First try to find the Object */
     if (ObjectNameInfo && ObjectNameInfo->Name.Buffer)
     {
-        DPRINT("Object has a name. Trying to find it: \"%wZ\".\n",
&ObjectNameInfo->Name);
+        DPRINT("Object has a name. Trying to find it: %wZ.\n",
&ObjectNameInfo->Name);
         Status = ObFindObject(ObjectCreateInfo,
                               &ObjectNameInfo->Name,
                               &FoundObject,
@@ -1132,10 +1132,7 @@
     
     /* We can delete the Create Info now */
     Header->ObjectCreateInfo = NULL;
-    ObpReleaseCapturedAttributes(ObjectCreateInfo,
-                                 NULL,
-                                 ObjectCreateInfo->ProbeMode,
-                                 FALSE);
+    ObpReleaseCapturedAttributes(ObjectCreateInfo);
     ExFreePool(ObjectCreateInfo);
     
     DPRINT("Status %x\n", Status);
  _____  

Modified: trunk/reactos/ntoskrnl/ob/namespc.c
--- trunk/reactos/ntoskrnl/ob/namespc.c	2005-08-08 16:57:50 UTC (rev
17216)
+++ trunk/reactos/ntoskrnl/ob/namespc.c	2005-08-08 16:58:30 UTC (rev
17217)
@@ -70,35 +70,20 @@

    NTSTATUS Status;
 
    PAGED_CODE();
-   
-   /* capture the ObjectPath */
-   Status = RtlCaptureUnicodeString(&ObjectName,
-                                    AccessMode,
-                                    NonPagedPool, /* FIXME */
-                                    FALSE,
-                                    ObjectPath);
-   if (!NT_SUCCESS(Status))
-     {
-	DPRINT("RtlCaptureUnicodeString() failed (Status %lx)\n",
Status);
-	return Status;
-     }
 
    InitializeObjectAttributes(&ObjectAttributes,
-			      &ObjectName,
+			      ObjectPath,
 			      Attributes | OBJ_OPENIF,
 			      NULL,
 			      NULL);
     
-   /* "Capture" all the info, it doesn't make sense to capture from the
kernel
-      stack as the information should be safe anyway...just do a raw
copy of the
-      data into the OBJECT_CREATE_INFORMATION structure */
+   /* Capture all the info */
    DPRINT("Capturing Create Info\n");
    Status = ObpCaptureObjectAttributes(&ObjectAttributes,
-                                       KernelMode, /* raw copy! */
-                                       NonPagedPool,
-                                       FALSE,
+                                       AccessMode,
+                                       ObjectType,
                                        &ObjectCreateInfo,
-                                       NULL);
+                                       &ObjectName);
    if (!NT_SUCCESS(Status))
      {
 	DPRINT("ObpCaptureObjectAttributes() failed (Status %lx)\n",
Status);
@@ -111,19 +96,9 @@
 			 &RemainingPath,
 			 ObjectType);
 
-   /* we don't need to release the "captured" object attributes!
Nothing was allocated! */
-#if 0
-   ObpReleaseCapturedAttributes(&ObjectCreateInfo,
-                                NULL,
-                                AccessMode,
-                                FALSE);
-#endif
+   ObpReleaseCapturedAttributes(&ObjectCreateInfo);
+   if (ObjectName.Buffer) ExFreePool(ObjectName.Buffer);
 
-   /* free the captured ObjectPath if needed */
-   RtlReleaseCapturedUnicodeString(&ObjectName,
-                                   AccessMode,
-                                   FALSE);
-
    if (!NT_SUCCESS(Status))
      {
 	return(Status);
@@ -194,8 +169,7 @@
     DPRINT("Capturing Create Info\n");
     Status = ObpCaptureObjectAttributes(ObjectAttributes,
                                         AccessMode,
-                                        PagedPool,
-                                        FALSE,
+                                        ObjectType,
                                         &ObjectCreateInfo,
                                         &ObjectName);
    if (!NT_SUCCESS(Status))
@@ -209,10 +183,8 @@
 			 &Object,
 			 &RemainingPath,
 			 ObjectType);
-   ObpReleaseCapturedAttributes(&ObjectCreateInfo,
-                                &ObjectName,
-                                AccessMode,
-                                FALSE);
+   ObpReleaseCapturedAttributes(&ObjectCreateInfo);
+   if (ObjectName.Buffer) ExFreePool(ObjectName.Buffer);
    if (!NT_SUCCESS(Status))
      {
 	DPRINT("ObFindObject() failed (Status %lx)\n", Status);
  _____  

Modified: trunk/reactos/ntoskrnl/ob/object.c
--- trunk/reactos/ntoskrnl/ob/object.c	2005-08-08 16:57:50 UTC (rev
17216)
+++ trunk/reactos/ntoskrnl/ob/object.c	2005-08-08 16:58:30 UTC (rev
17217)
@@ -110,297 +110,162 @@

 
 NTSTATUS
 STDCALL
-ObpCaptureObjectAttributes(IN POBJECT_ATTRIBUTES ObjectAttributes
OPTIONAL,
+ObpCaptureObjectAttributes(IN POBJECT_ATTRIBUTES ObjectAttributes,
                            IN KPROCESSOR_MODE AccessMode,
-                           IN POOL_TYPE PoolType,
-                           IN BOOLEAN CaptureIfKernel,
-                           OUT POBJECT_CREATE_INFORMATION
CapturedObjectAttributes  OPTIONAL,
-                           OUT PUNICODE_STRING ObjectName  OPTIONAL)
+                           IN POBJECT_TYPE ObjectType,
+                           IN POBJECT_CREATE_INFORMATION
ObjectCreateInfo,
+                           OUT PUNICODE_STRING ObjectName)
 {
-    OBJECT_ATTRIBUTES AttributesCopy;
     NTSTATUS Status = STATUS_SUCCESS;
+    PSECURITY_DESCRIPTOR SecurityDescriptor;
+    PSECURITY_QUALITY_OF_SERVICE SecurityQos;
+    PUNICODE_STRING LocalObjectName = NULL;
 
-    /* at least one output parameter must be != NULL! */
-    ASSERT(CapturedObjectAttributes != NULL || ObjectName != NULL);
-
-    if (ObjectAttributes == NULL)
+    /* Zero out the Capture Data */
+    DPRINT("ObpCaptureObjectAttributes\n");
+    RtlZeroMemory(ObjectCreateInfo, sizeof(OBJECT_CREATE_INFORMATION));
+    
+    /* Check if we got Oba */
+    if (ObjectAttributes)
     {
-        /* we're going to return STATUS_SUCCESS! */
-        goto failbasiccleanup;
-    }
-
-    if (AccessMode != KernelMode)
-    {
-        _SEH_TRY
+        if (AccessMode != KernelMode)
         {
-            ProbeForRead(ObjectAttributes,
-                         sizeof(ObjectAttributes),
-                         sizeof(ULONG));
-            /* make a copy on the stack */
-            AttributesCopy = *ObjectAttributes;
-        }
-        _SEH_HANDLE
-        {
-            Status = _SEH_GetExceptionCode();
-        }
-        _SEH_END;
-
-        if(!NT_SUCCESS(Status))
-        {
-            DPRINT1("ObpCaptureObjectAttributes failed to probe object
attributes 0x%p\n", ObjectAttributes);
-            goto failbasiccleanup;
-        }
-    }
-    else if (!CaptureIfKernel)
-    {
-        if (ObjectAttributes->Length == sizeof(OBJECT_ATTRIBUTES))
-        {
-            if (ObjectName != NULL)
+            DPRINT("Probing OBA\n");
+            _SEH_TRY
             {
-                /* we don't have to capture any memory, the caller
considers the passed data
-                   as valid */
-                if (ObjectAttributes->ObjectName != NULL)
-                {
-                    *ObjectName = *ObjectAttributes->ObjectName;
-                }
-                else
-                {
-                    ObjectName->Length = ObjectName->MaximumLength = 0;
-                    ObjectName->Buffer = NULL;
-                }
+                /* FIXME: SMSS SENDS BULLSHIT. */
+                #if 0
+                ProbeForRead(ObjectAttributes,
+                             sizeof(ObjectAttributes),
+                             sizeof(ULONG));
+                #endif
             }
-            if (CapturedObjectAttributes != NULL)
+            _SEH_HANDLE
             {
-                CapturedObjectAttributes->RootDirectory =
ObjectAttributes->RootDirectory;
-                CapturedObjectAttributes->Attributes =
ObjectAttributes->Attributes;
-                CapturedObjectAttributes->SecurityDescriptor =
ObjectAttributes->SecurityDescriptor;
-                CapturedObjectAttributes->SecurityDescriptorCharge = 0;
/* FIXME */
-                CapturedObjectAttributes->ProbeMode = AccessMode;
+                Status = _SEH_GetExceptionCode();
             }
-
-            return STATUS_SUCCESS;
+            _SEH_END;
         }
-        else
+        
+        /* Validate the Size */
+        DPRINT("Validating OBA\n");
+        if (ObjectAttributes->Length != sizeof(OBJECT_ATTRIBUTES))
         {
             Status = STATUS_INVALID_PARAMETER;
-            goto failbasiccleanup;
         }
-    }
-    else
-    {
-        AttributesCopy = *ObjectAttributes;
-    }
 
-    /* if Length isn't as expected, bail with an invalid parameter
status code so
-       the caller knows he passed garbage... */
-    if (AttributesCopy.Length != sizeof(OBJECT_ATTRIBUTES))
-    {
-        Status = STATUS_INVALID_PARAMETER;
-        goto failbasiccleanup;
-    }
-
-    if (CapturedObjectAttributes != NULL)
-    {
-        CapturedObjectAttributes->RootDirectory =
AttributesCopy.RootDirectory;
-        CapturedObjectAttributes->Attributes =
AttributesCopy.Attributes;
-
-        if (AttributesCopy.SecurityDescriptor != NULL)
+        /* Fail if SEH or Size Validation failed */
+        if(!NT_SUCCESS(Status))
         {
-            Status =
SeCaptureSecurityDescriptor(AttributesCopy.SecurityDescriptor,
+            DPRINT1("ObpCaptureObjectAttributes failed to probe object
attributes\n");
+            goto fail;
+        }
+        
+        /* Set some Create Info */
+        DPRINT("Creating OBCI\n");
+        ObjectCreateInfo->RootDirectory =
ObjectAttributes->RootDirectory;
+        ObjectCreateInfo->Attributes = ObjectAttributes->Attributes;
+        LocalObjectName = ObjectAttributes->ObjectName;
+        SecurityDescriptor = ObjectAttributes->SecurityDescriptor;
+        SecurityQos = ObjectAttributes->SecurityQualityOfService;
+        
+        /* Validate the SD */
+        if (SecurityDescriptor)
+        {
+            DPRINT("Probing SD: %x\n", SecurityDescriptor);
+            Status = SeCaptureSecurityDescriptor(SecurityDescriptor,
                                                  AccessMode,
-                                                 PoolType,
+                                                 NonPagedPool,
                                                  TRUE,
-
&CapturedObjectAttributes->SecurityDescriptor);
-            if (!NT_SUCCESS(Status))
+
&ObjectCreateInfo->SecurityDescriptor);
+            if(!NT_SUCCESS(Status))
             {
                 DPRINT1("Unable to capture the security
descriptor!!!\n");
-                goto failbasiccleanup;
+                ObjectCreateInfo->SecurityDescriptor = NULL;
+                goto fail;
             }
-            CapturedObjectAttributes->SecurityDescriptorCharge = 0; /*
FIXME */
+            
+            DPRINT("Probe done\n");
+            ObjectCreateInfo->SecurityDescriptorCharge = 0; /* FIXME */
+            ObjectCreateInfo->ProbeMode = AccessMode;
         }
-        else
+        
+        /* Validate the QoS */
+        if (SecurityQos)
         {
-            CapturedObjectAttributes->SecurityDescriptor = NULL;
-            CapturedObjectAttributes->SecurityDescriptorCharge = 0;
-        }
-    }
-
-    if (ObjectName != NULL)
-    {
-        ObjectName->Buffer = NULL;
-
-        if (AttributesCopy.ObjectName != NULL)
-        {
-            UNICODE_STRING OriginalCopy = {0};
-
             if (AccessMode != KernelMode)
             {
+                DPRINT("Probing QoS\n");
                 _SEH_TRY
                 {
-                    /* probe the ObjectName structure and make a local
stack copy of it */
-                    ProbeForRead(AttributesCopy.ObjectName,
-                                 sizeof(UNICODE_STRING),
+                    ProbeForRead(SecurityQos,
+                                 sizeof(SECURITY_QUALITY_OF_SERVICE),
                                  sizeof(ULONG));
-                    OriginalCopy = *AttributesCopy.ObjectName;
-                    if (OriginalCopy.Length > 0)
-                    {
-                        ProbeForRead(OriginalCopy.Buffer,
-                                     OriginalCopy.Length,
-                                     sizeof(WCHAR));
-                    }
                 }
                 _SEH_HANDLE
                 {
                     Status = _SEH_GetExceptionCode();
                 }
                 _SEH_END;
-
-                if (NT_SUCCESS(Status))
-                {
-                    ObjectName->Length = OriginalCopy.Length;
-                    
-                    if(OriginalCopy.Length > 0)
-                    {
-                        ObjectName->MaximumLength = OriginalCopy.Length
+ sizeof(WCHAR);
-                        ObjectName->Buffer = ExAllocatePool(PoolType,
-
ObjectName->MaximumLength);
-                        if (ObjectName->Buffer != NULL)
-                        {
-                            _SEH_TRY
-                            {
-                                /* no need to probe OriginalCopy.Buffer
again, we already did that
-                                   when capturing the UNICODE_STRING
structure itself */
-                                RtlCopyMemory(ObjectName->Buffer,
OriginalCopy.Buffer, OriginalCopy.Length);
-                                ObjectName->Buffer[OriginalCopy.Length
/ sizeof(WCHAR)] = L'\0';
-                            }
-                            _SEH_HANDLE
-                            {
-                                Status = _SEH_GetExceptionCode();
-                            }
-                            _SEH_END;
-
-                            if (!NT_SUCCESS(Status))
-                            {
-                                DPRINT1("ObpCaptureObjectAttributes
failed to copy the unicode string!\n");
-                            }
-                        }
-                        else
-                        {
-                            Status = STATUS_INSUFFICIENT_RESOURCES;
-                        }
-                    }
-                    else if(AttributesCopy.RootDirectory != NULL /* &&
OriginalCopy.Length == 0 */)
-                    {
-                        /* if the caller specified a root directory,
there must be an object name! */
-                        Status = STATUS_OBJECT_NAME_INVALID;
-                    }
-                    else
-                    {
-                        ObjectName->Length = ObjectName->MaximumLength
= 0;
-                    }
-                }
-#ifdef DBG
-                else
-                {
-                    DPRINT1("ObpCaptureObjectAttributes failed to probe
the object name UNICODE_STRING structure!\n");
-                }
-#endif
             }
-            else /* AccessMode == KernelMode */
-            {
-                OriginalCopy = *AttributesCopy.ObjectName;
-                ObjectName->Length = OriginalCopy.Length;
 
-                if (OriginalCopy.Length > 0)
-                {
-                    ObjectName->MaximumLength = OriginalCopy.Length +
sizeof(WCHAR);
-                    ObjectName->Buffer = ExAllocatePool(PoolType,
-
ObjectName->MaximumLength);
-                    if (ObjectName->Buffer != NULL)
-                    {
-                        RtlCopyMemory(ObjectName->Buffer,
OriginalCopy.Buffer, OriginalCopy.Length);
-                        ObjectName->Buffer[OriginalCopy.Length /
sizeof(WCHAR)] = L'\0';
-                    }
-                    else
-                    {
-                        Status = STATUS_INSUFFICIENT_RESOURCES;
-                    }
-                }
-                else if (AttributesCopy.RootDirectory != NULL /* &&
OriginalCopy.Length == 0 */)
-                {
-                    /* if the caller specified a root directory, there
must be an object name! */
-                    Status = STATUS_OBJECT_NAME_INVALID;
-                }
-                else
-                {
-                    ObjectName->Length = ObjectName->MaximumLength = 0;
-                }
+            if(!NT_SUCCESS(Status))
+            {
+                DPRINT1("Unable to capture QoS!!!\n");
+                goto fail;
             }
+            
+            ObjectCreateInfo->SecurityQualityOfService = *SecurityQos;
+            ObjectCreateInfo->SecurityQos =
&ObjectCreateInfo->SecurityQualityOfService;
         }
-        else
+    }
+    
+    /* Clear Local Object Name */
+    DPRINT("Clearing name\n");
+    RtlZeroMemory(ObjectName, sizeof(UNICODE_STRING));
+    
+    /* Now check if the Object Attributes had an Object Name */
+    if (LocalObjectName)
+    {
+        DPRINT("Name Buffer: %x\n", LocalObjectName->Buffer);
+        Status = ObpCaptureObjectName(ObjectName,
+                                      LocalObjectName,
+                                      AccessMode);
+    }
+    else
+    {
+        /* He can't have specified a Root Directory */
+        if (ObjectCreateInfo->RootDirectory)
         {
-            ObjectName->Length = ObjectName->MaximumLength = 0;
+            DPRINT1("Invalid name\n");
+            Status = STATUS_OBJECT_NAME_INVALID;
         }
     }
     
-    CapturedObjectAttributes->ProbeMode = AccessMode;
-
+fail:
     if (!NT_SUCCESS(Status))
     {
-        if (ObjectName != NULL && ObjectName->Buffer)
-        {
-            ExFreePool(ObjectName->Buffer);
-        }
-        if (CapturedObjectAttributes != NULL)
-        {
-            /* cleanup allocated resources */
-
SeReleaseSecurityDescriptor(CapturedObjectAttributes->SecurityDescriptor
,
-                                        AccessMode,
-                                        TRUE);
-        }
-
-failbasiccleanup:
-        if (ObjectName != NULL)
-        {
-            ObjectName->Length = ObjectName->MaximumLength = 0;
-            ObjectName->Buffer = NULL;
-        }
-        if (CapturedObjectAttributes != NULL)
-        {
-            RtlZeroMemory(CapturedObjectAttributes,
sizeof(OBJECT_CREATE_INFORMATION));
-        }
+        DPRINT1("Failed to capture, cleaning up\n");
+        ObpReleaseCapturedAttributes(ObjectCreateInfo);
     }
-
+    
+    DPRINT("Return to caller\n");
     return Status;
 }
 
 
 VOID
 STDCALL
-ObpReleaseCapturedAttributes(IN POBJECT_CREATE_INFORMATION
CapturedObjectAttributes  OPTIONAL,
-                             IN PUNICODE_STRING ObjectName  OPTIONAL,
-                             IN KPROCESSOR_MODE AccessMode,
-                             IN BOOLEAN CaptureIfKernel)
+ObpReleaseCapturedAttributes(IN POBJECT_CREATE_INFORMATION
ObjectCreateInfo)
 {
-  /* WARNING - You need to pass the same parameters to this function as
you passed
-               to ObpCaptureObjectAttributes() to avoid memory leaks */
-  if(AccessMode != KernelMode || CaptureIfKernel)
-  {
-    if(CapturedObjectAttributes != NULL &&
-       CapturedObjectAttributes->SecurityDescriptor != NULL)
+    /* Release the SD, it's the only thing we allocated */
+    if (ObjectCreateInfo->SecurityDescriptor)
     {
-      ExFreePool(CapturedObjectAttributes->SecurityDescriptor);
-
-#ifdef DBG
-      RtlZeroMemory(CapturedObjectAttributes,
sizeof(OBJECT_CREATE_INFORMATION));
-#endif
+
SeReleaseSecurityDescriptor(ObjectCreateInfo->SecurityDescriptor,
+                                    ObjectCreateInfo->ProbeMode,
+                                    TRUE);
+        ObjectCreateInfo->SecurityDescriptor = NULL;
}
-    if(ObjectName != NULL &&
-       ObjectName->Length > 0)
-    {
-      ExFreePool(ObjectName->Buffer);
-    }
-  }
 }
 
 
@@ -483,7 +348,7 @@
       ObjectName->Buffer[0] != L'\\')
     {
       ObDereferenceObject (CurrentObject);
-      DPRINT1("failed: \"%wZ\"\n", ObjectName);
+      DPRINT1("failed\n");
       return STATUS_UNSUCCESSFUL;
     }
 
@@ -930,9 +795,8 @@
     /* Capture all the info */
     DPRINT("Capturing Create Info\n");
     Status = ObpCaptureObjectAttributes(ObjectAttributes,
-                                        ObjectAttributesAccessMode,
-                                        NonPagedPool,
-                                        TRUE,
+                                        AccessMode,
+                                        Type,
                                         ObjectCreateInfo,
                                         &ObjectName);
                                         
@@ -958,10 +822,8 @@
         
         /* Release the Capture Info, we don't need it */
         DPRINT1("Allocation failed\n");
-        ObpReleaseCapturedAttributes(ObjectCreateInfo,
-                                     &ObjectName,
-                                     ObjectAttributesAccessMode,
-                                     TRUE);
+        ObpReleaseCapturedAttributes(ObjectCreateInfo);
+        if (ObjectName.Buffer) ExFreePool(ObjectName.Buffer);
     }
      
     /* We failed, so release the Buffer */
@@ -1115,10 +977,7 @@
     }
   if (Header->ObjectCreateInfo)
     {
-      ObpReleaseCapturedAttributes(Header->ObjectCreateInfo,
-                                   NULL,
-                                   Header->ObjectCreateInfo->ProbeMode,
-                                   FALSE);
+      ObpReleaseCapturedAttributes(Header->ObjectCreateInfo);
       ExFreePool(Header->ObjectCreateInfo);
     }