[ekohl] 56800: [NTOSKRNL] Fix error handling for SepDuplicateToken and SeCreateToken.

Author: ekohl
Date: Sun Jun 24 21:04:11 2012
New Revision: 56800
URL: http://svn.reactos.org/svn/reactos?rev=56800&view=rev
Log:
[NTOSKRNL]
Fix error handling for SepDuplicateToken and SeCreateToken.
Modified:
    trunk/reactos/ntoskrnl/se/token.c
Modified: trunk/reactos/ntoskrnl/se/token.c
URL:
http://svn.reactos.org/svn/reactos/trunk/reactos/ntoskrnl/se/token.c?rev=56…
==============================================================================
--- trunk/reactos/ntoskrnl/se/token.c [iso-8859-1] (original)
+++ trunk/reactos/ntoskrnl/se/token.c [iso-8859-1] Sun Jun 24 21:04:11 2012
@@ -234,7 +234,7 @@
     ULONG uLength;
     ULONG i;
     PVOID EndMem;
-    PTOKEN AccessToken;
+    PTOKEN AccessToken = NULL;
     NTSTATUS Status;
     PAGED_CODE();
@@ -290,10 +290,14 @@
     for (i = 0; i < Token->UserAndGroupCount; i++)
         uLength += RtlLengthSid(Token->UserAndGroups[i].Sid);
-    AccessToken->UserAndGroups =
-    (PSID_AND_ATTRIBUTES)ExAllocatePoolWithTag(PagedPool,
-                                               uLength,
-                                               TAG_TOKEN_USERS);
+    AccessToken->UserAndGroups = ExAllocatePoolWithTag(PagedPool,
+                                                       uLength,
+                                                       TAG_TOKEN_USERS);
+    if (AccessToken->UserAndGroups == NULL)
+    {
+        Status = STATUS_INSUFFICIENT_RESOURCES;
+        goto done;
+    }
     EndMem = &AccessToken->UserAndGroups[AccessToken->UserAndGroupCount];
@@ -304,48 +308,69 @@
                                           EndMem,
                                           &EndMem,
                                           &uLength);
-    if (NT_SUCCESS(Status))
-    {
-        Status = SepFindPrimaryGroupAndDefaultOwner(
-                                                    AccessToken,
-                                                    Token->PrimaryGroup,
-                                                    0);
-    }
-
-    if (NT_SUCCESS(Status))
-    {
-        AccessToken->PrivilegeCount = Token->PrivilegeCount;
-
-        uLength = AccessToken->PrivilegeCount * sizeof(LUID_AND_ATTRIBUTES);
-        AccessToken->Privileges =
-        (PLUID_AND_ATTRIBUTES)ExAllocatePoolWithTag(PagedPool,
+    if (!NT_SUCCESS(Status))
+        goto done;
+
+    Status = SepFindPrimaryGroupAndDefaultOwner(AccessToken,
+                                                Token->PrimaryGroup,
+                                                0);
+    if (!NT_SUCCESS(Status))
+        goto done;
+
+    AccessToken->PrivilegeCount = Token->PrivilegeCount;
+
+    uLength = AccessToken->PrivilegeCount * sizeof(LUID_AND_ATTRIBUTES);
+    AccessToken->Privileges = ExAllocatePoolWithTag(PagedPool,
                                                     uLength,
                                                     TAG_TOKEN_PRIVILAGES);
-
-        for (i = 0; i < AccessToken->PrivilegeCount; i++)
-        {
-            RtlCopyLuid(&AccessToken->Privileges[i].Luid,
-                        &Token->Privileges[i].Luid);
-            AccessToken->Privileges[i].Attributes =
-            Token->Privileges[i].Attributes;
-        }
-
-        if (Token->DefaultDacl)
-        {
-            AccessToken->DefaultDacl =
-            (PACL) ExAllocatePoolWithTag(PagedPool,
-                                         Token->DefaultDacl->AclSize,
-                                         TAG_TOKEN_ACL);
-            memcpy(AccessToken->DefaultDacl,
-                   Token->DefaultDacl,
-                   Token->DefaultDacl->AclSize);
-        }
-    }
-
-    if (NT_SUCCESS(Status))
-    {
-        *NewAccessToken = AccessToken;
-        return(STATUS_SUCCESS);
+    if (AccessToken->Privileges == NULL)
+    {
+        Status = STATUS_INSUFFICIENT_RESOURCES;
+        goto done;
+    }
+
+    for (i = 0; i < AccessToken->PrivilegeCount; i++)
+    {
+        RtlCopyLuid(&AccessToken->Privileges[i].Luid,
+                    &Token->Privileges[i].Luid);
+        AccessToken->Privileges[i].Attributes =
+        Token->Privileges[i].Attributes;
+    }
+
+    if (Token->DefaultDacl)
+    {
+        AccessToken->DefaultDacl = ExAllocatePoolWithTag(PagedPool,
+
Token->DefaultDacl->AclSize,
+                                                         TAG_TOKEN_ACL);
+        if (AccessToken->DefaultDacl == NULL)
+        {
+            Status = STATUS_INSUFFICIENT_RESOURCES;
+            goto done;
+        }
+
+        memcpy(AccessToken->DefaultDacl,
+               Token->DefaultDacl,
+               Token->DefaultDacl->AclSize);
+    }
+
+    *NewAccessToken = AccessToken;
+
+done:
+    if (!NT_SUCCESS(Status))
+    {
+        if (AccessToken)
+        {
+            if (AccessToken->UserAndGroups)
+                ExFreePoolWithTag(AccessToken->UserAndGroups, TAG_TOKEN_USERS);
+
+            if (AccessToken->Privileges)
+                ExFreePoolWithTag(AccessToken->Privileges, TAG_TOKEN_PRIVILAGES);
+
+            if (AccessToken->DefaultDacl)
+                ExFreePoolWithTag(AccessToken->DefaultDacl, TAG_TOKEN_ACL);
+
+            ObDereferenceObject(AccessToken);
+        }
     }
     return Status;
@@ -636,10 +661,14 @@
     for (i = 0; i < GroupCount; i++)
         uLength += RtlLengthSid(Groups[i].Sid);
-    AccessToken->UserAndGroups =
-    (PSID_AND_ATTRIBUTES)ExAllocatePoolWithTag(PagedPool,
-                                               uLength,
-                                               TAG_TOKEN_USERS);
+    AccessToken->UserAndGroups = ExAllocatePoolWithTag(PagedPool,
+                                                       uLength,
+                                                       TAG_TOKEN_USERS);
+    if (AccessToken->UserAndGroups == NULL)
+    {
+        Status = STATUS_INSUFFICIENT_RESOURCES;
+        goto done;
+    }
     EndMem = &AccessToken->UserAndGroups[AccessToken->UserAndGroupCount];
@@ -650,65 +679,71 @@
                                           EndMem,
                                           &EndMem,
                                           &uLength);
-    if (NT_SUCCESS(Status))
-    {
-        Status = RtlCopySidAndAttributesArray(GroupCount,
-                                              Groups,
-                                              uLength,
-                                              &AccessToken->UserAndGroups[1],
-                                              EndMem,
-                                              &EndMem,
-                                              &uLength);
-    }
-
-    if (NT_SUCCESS(Status))
-    {
-        Status = SepFindPrimaryGroupAndDefaultOwner(
-                                                    AccessToken,
-                                                    PrimaryGroup,
-                                                    Owner);
-    }
-
-    if (NT_SUCCESS(Status))
-    {
-        uLength = PrivilegeCount * sizeof(LUID_AND_ATTRIBUTES);
-        AccessToken->Privileges =
-        (PLUID_AND_ATTRIBUTES)ExAllocatePoolWithTag(PagedPool,
+    if (!NT_SUCCESS(Status))
+        goto done;
+
+    Status = RtlCopySidAndAttributesArray(GroupCount,
+                                          Groups,
+                                          uLength,
+                                          &AccessToken->UserAndGroups[1],
+                                          EndMem,
+                                          &EndMem,
+                                          &uLength);
+    if (!NT_SUCCESS(Status))
+        goto done;
+
+    Status = SepFindPrimaryGroupAndDefaultOwner(AccessToken,
+                                                PrimaryGroup,
+                                                Owner);
+    if (!NT_SUCCESS(Status))
+        goto done;
+
+    uLength = PrivilegeCount * sizeof(LUID_AND_ATTRIBUTES);
+    AccessToken->Privileges = ExAllocatePoolWithTag(PagedPool,
                                                     uLength,
                                                     TAG_TOKEN_PRIVILAGES);
-
-        if (PreviousMode != KernelMode)
-        {
-            _SEH2_TRY
-            {
-                RtlCopyMemory(AccessToken->Privileges,
-                              Privileges,
-                              PrivilegeCount * sizeof(LUID_AND_ATTRIBUTES));
-            }
-            _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
-            {
-                Status = _SEH2_GetExceptionCode();
-            }
-            _SEH2_END;
-        }
-        else
+    if (AccessToken->Privileges == NULL)
+    {
+        Status = STATUS_INSUFFICIENT_RESOURCES;
+        goto done;
+    }
+
+    if (PreviousMode != KernelMode)
+    {
+        _SEH2_TRY
         {
             RtlCopyMemory(AccessToken->Privileges,
                           Privileges,
                           PrivilegeCount * sizeof(LUID_AND_ATTRIBUTES));
         }
-    }
-
-    if (NT_SUCCESS(Status))
-    {
-        AccessToken->DefaultDacl =
-        (PACL) ExAllocatePoolWithTag(PagedPool,
-                                     DefaultDacl->AclSize,
-                                     TAG_TOKEN_ACL);
-        memcpy(AccessToken->DefaultDacl,
-               DefaultDacl,
-               DefaultDacl->AclSize);
-    }
+        _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
+        {
+            Status = _SEH2_GetExceptionCode();
+        }
+        _SEH2_END;
+    }
+    else
+    {
+        RtlCopyMemory(AccessToken->Privileges,
+                      Privileges,
+                      PrivilegeCount * sizeof(LUID_AND_ATTRIBUTES));
+    }
+
+    if (!NT_SUCCESS(Status))
+        goto done;
+
+    AccessToken->DefaultDacl = ExAllocatePoolWithTag(PagedPool,
+                                                     DefaultDacl->AclSize,
+                                                     TAG_TOKEN_ACL);
+    if (AccessToken->DefaultDacl == NULL)
+    {
+        Status = STATUS_INSUFFICIENT_RESOURCES;
+        goto done;
+    }
+
+    RtlCopyMemory(AccessToken->DefaultDacl,
+                  DefaultDacl,
+                  DefaultDacl->AclSize);
     if (!SystemToken)
     {
@@ -727,6 +762,24 @@
     {
         /* Return pointer instead of handle */
         *TokenHandle = (HANDLE)AccessToken;
+    }
+
+done:
+    if (!NT_SUCCESS(Status))
+    {
+        if (AccessToken)
+        {
+            if (AccessToken->UserAndGroups)
+                ExFreePoolWithTag(AccessToken->UserAndGroups, TAG_TOKEN_USERS);
+
+            if (AccessToken->Privileges)
+                ExFreePoolWithTag(AccessToken->Privileges, TAG_TOKEN_PRIVILAGES);
+
+            if (AccessToken->DefaultDacl)
+                ExFreePoolWithTag(AccessToken->DefaultDacl, TAG_TOKEN_ACL);
+
+            ObDereferenceObject(AccessToken);
+        }
     }
     return Status;