[tfaber] 57127: [DEVMGR] - Actually fail on error in AllocAndLoadStringsCat (CID 716793/716794) [IPHLPAPI] - Fix a use after free in getNthInterfaceEntity (CID 716795 - partly reverts r53190). Fix ...

Author: tfaber
Date: Wed Aug 22 09:39:57 2012
New Revision: 57127

URL: http://svn.reactos.org/svn/reactos?rev=57127&view=rev
Log:
[DEVMGR] - Actually fail on error in AllocAndLoadStringsCat (CID 716793/716794)
[IPHLPAPI] - Fix a use after free in getNthInterfaceEntity (CID 716795 - partly reverts
r53190). Fix a possible double free in getArpTable (CID 716796).

Modified:
    trunk/reactos/dll/win32/devmgr/misc.c
    trunk/reactos/dll/win32/iphlpapi/ifenum_reactos.c
    trunk/reactos/dll/win32/iphlpapi/ipstats_reactos.c

Modified: trunk/reactos/dll/win32/devmgr/misc.c
URL:
http://svn.reactos.org/svn/reactos/trunk/reactos/dll/win32/devmgr/misc.c?re…
==============================================================================
--- trunk/reactos/dll/win32/devmgr/misc.c [iso-8859-1] (original)
+++ trunk/reactos/dll/win32/devmgr/misc.c [iso-8859-1] Wed Aug 22 09:39:57 2012
@@ -130,6 +130,7 @@
                 if (!(Ret = LoadStringW(hInst, uID[i], s, ln)))
                 {
                     LocalFree((HLOCAL)(*lpTarget));
+                    return 0;
                 }
 
                 s += Ret;

Modified: trunk/reactos/dll/win32/iphlpapi/ifenum_reactos.c
URL:
http://svn.reactos.org/svn/reactos/trunk/reactos/dll/win32/iphlpapi/ifenum_…
==============================================================================
--- trunk/reactos/dll/win32/iphlpapi/ifenum_reactos.c [iso-8859-1] (original)
+++ trunk/reactos/dll/win32/iphlpapi/ifenum_reactos.c [iso-8859-1] Wed Aug 22 09:39:57
2012
@@ -287,12 +287,12 @@
     TRACE("Index %d is entity #%d - %04x:%08x\n", index, i,
            entitySet[i].tei_entity, entitySet[i].tei_instance );
 
-    tdiFreeThingSet( entitySet );
-
     if( numInterfaces == index && i < numEntities ) {
         memcpy( ent, &entitySet[i], sizeof(*ent) );
+        tdiFreeThingSet( entitySet );
         return STATUS_SUCCESS;
     } else {
+        tdiFreeThingSet( entitySet );
         return STATUS_UNSUCCESSFUL;
     }
 }

Modified: trunk/reactos/dll/win32/iphlpapi/ipstats_reactos.c
URL:
http://svn.reactos.org/svn/reactos/trunk/reactos/dll/win32/iphlpapi/ipstats…
==============================================================================
--- trunk/reactos/dll/win32/iphlpapi/ipstats_reactos.c [iso-8859-1] (original)
+++ trunk/reactos/dll/win32/iphlpapi/ipstats_reactos.c [iso-8859-1] Wed Aug 22 09:39:57
2012
@@ -582,13 +582,12 @@
 					(PVOID *)&AdapterArpTable,
 					&returnSize );
 
-	    if( status == STATUS_SUCCESS ) {
-		for( TmpIdx = 0; TmpIdx < returnSize; TmpIdx++, CurrIdx++ )
-		    IpArpTable->table[CurrIdx] = AdapterArpTable[TmpIdx];
-	    }
-
-	    if( AdapterArpTable ) tdiFreeThingSet( AdapterArpTable );
-	}
+            if( status == STATUS_SUCCESS ) {
+                for( TmpIdx = 0; TmpIdx < returnSize; TmpIdx++, CurrIdx++ )
+                    IpArpTable->table[CurrIdx] = AdapterArpTable[TmpIdx];
+                tdiFreeThingSet( AdapterArpTable );
+            }
+        }
     }
 
     closeTcpFile( tcpFile );