https://git.reactos.org/?p=reactos.git;a=commitdiff;h=2e1aeb12dfd8b44b4b57d…
commit 2e1aeb12dfd8b44b4b57d377b59ef347dfe3386e
Author:     Thomas Brogan <brogan.tom.iii(a)gmail.com>
AuthorDate: Tue Jul 28 00:08:00 2020 +0300
Commit:     Thomas Faber <thomas.faber(a)reactos.org>
CommitDate: Sat Oct 3 13:05:12 2020 +0200
    [TCPIP] Add NULL checks in DispTdiQueryInformation. CORE-12274
    Add additional NULL checks to DispTdiQueryInformation,
    which return STATUS_INVALID_PARAMETER.
    Co-authored-by: Peter Hater <7element(a)mail.bg>
---
 drivers/network/tcpip/tcpip/dispatch.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)
diff --git a/drivers/network/tcpip/tcpip/dispatch.c
b/drivers/network/tcpip/tcpip/dispatch.c
index bb3625c731c..da2a00ba5bd 100644
--- a/drivers/network/tcpip/tcpip/dispatch.c
+++ b/drivers/network/tcpip/tcpip/dispatch.c
@@ -711,6 +711,12 @@ NTSTATUS DispTdiQueryInformation(
         switch ((ULONG_PTR)IrpSp->FileObject->FsContext2) {
           case TDI_TRANSPORT_ADDRESS_FILE:
             AddrFile = (PADDRESS_FILE)TranContext->Handle.AddressHandle;
+            if (AddrFile == NULL)
+            {
+                TI_DbgPrint(MIN_TRACE, ("FIXME: No address file object.\n"));
+                ASSERT(AddrFile != NULL);
+                return STATUS_INVALID_PARAMETER;
+            }
                        Address->TAAddressCount = 1;
                        Address->Address[0].AddressLength = TDI_ADDRESS_LENGTH_IP;
@@ -725,6 +731,12 @@ NTSTATUS DispTdiQueryInformation(
           case TDI_CONNECTION_FILE:
             Endpoint =
(PCONNECTION_ENDPOINT)TranContext->Handle.ConnectionContext;
+            if (Endpoint == NULL || Endpoint->AddressFile == NULL)
+            {
+                TI_DbgPrint(MIN_TRACE, ("FIXME: No connection endpoint file
object.\n"));
+                ASSERT(Endpoint != NULL && Endpoint->AddressFile != NULL);
+                return STATUS_INVALID_PARAMETER;
+            }
             Address->TAAddressCount = 1;
             Address->Address[0].AddressLength = TDI_ADDRESS_LENGTH_IP;