https://git.reactos.org/?p=reactos.git;a=commitdiff;h=bc002f17087d912f1148b…
commit bc002f17087d912f1148b988299aa523f28e927c
Author: Thomas Faber <thomas.faber(a)reactos.org>
AuthorDate: Sat Jan 12 16:25:52 2019 +0100
Commit: Thomas Faber <thomas.faber(a)reactos.org>
CommitDate: Sat Jan 12 16:27:37 2019 +0100
[FASTFAT] Avoid a use after free in VfatCloseFile.
---
drivers/filesystems/fastfat/close.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/drivers/filesystems/fastfat/close.c b/drivers/filesystems/fastfat/close.c
index b6c250f92c..57efdad97a 100644
--- a/drivers/filesystems/fastfat/close.c
+++ b/drivers/filesystems/fastfat/close.c
@@ -163,6 +163,7 @@ VfatCloseFile(
{
PVFATFCB pFcb;
PVFATCCB pCcb;
+ BOOLEAN IsVolume;
NTSTATUS Status = STATUS_SUCCESS;
DPRINT("VfatCloseFile(DeviceExt %p, FileObject %p)\n",
@@ -177,6 +178,8 @@ VfatCloseFile(
return STATUS_SUCCESS;
}
+ IsVolume = BooleanFlagOn(pFcb->Flags, FCB_IS_VOLUME);
+
if (pCcb)
{
vfatDestroyCCB(pCcb);
@@ -194,7 +197,7 @@ VfatCloseFile(
FileObject->SectionObjectPointer = NULL;
#ifdef ENABLE_SWAPOUT
- if (BooleanFlagOn(pFcb->Flags, FCB_IS_VOLUME) &&
DeviceExt->OpenHandleCount == 0)
+ if (IsVolume && DeviceExt->OpenHandleCount == 0)
{
VfatCheckForDismount(DeviceExt, FALSE);
}