Added two missing dereferencing calls in ObReferenceObjectByHandle.
Checked also for NtCurrentThread in NtDuplicateObject.
Used the return value from InterlockedIncrement to check for a correct
handle count.
Modified: trunk/reactos/ntoskrnl/ob/handle.c
_____
Modified: trunk/reactos/ntoskrnl/ob/handle.c
--- trunk/reactos/ntoskrnl/ob/handle.c 2005-03-19 09:14:21 UTC (rev
14187)
+++ trunk/reactos/ntoskrnl/ob/handle.c 2005-03-19 09:18:58 UTC (rev
14188)
@@ -166,6 +166,7 @@
POBJECT_HEADER ObjectHeader;
LONG ExTargetHandle;
LONG ExSourceHandle = HANDLE_TO_EX_HANDLE(SourceHandle);
+ ULONG NewHandleCount;
PAGED_CODE();
@@ -200,8 +201,8 @@
1 here, we're in big trouble... it would've been safe to increment
and
check the handle count without using interlocked functions because
the
entry is locked, which means the handle count can't change. */
- InterlockedIncrement(&ObjectHeader->HandleCount);
- ASSERT(ObjectHeader->HandleCount >= 2);
+ NewHandleCount = InterlockedIncrement(&ObjectHeader->HandleCount);
+ ASSERT(NewHandleCount >= 2);
ExUnlockHandleTableEntry(SourceProcess->ObjectTable,
SourceHandleEntry);
@@ -329,7 +330,8 @@
}
/* Check for magic handle first */
- if (SourceHandle == NtCurrentThread())
+ if (SourceHandle == NtCurrentThread() ||
+ SourceHandle == NtCurrentProcess())
{
PVOID ObjectBody;
@@ -746,6 +748,7 @@
HandleEntry);
KeLeaveCriticalRegion();
+ ObDereferenceObject(ObjectBody);
return(STATUS_OBJECT_TYPE_MISMATCH);
}
@@ -762,6 +765,7 @@
if (!(GrantedAccess & DesiredAccess) &&
!((~GrantedAccess) & DesiredAccess))
{
+ ObDereferenceObject(ObjectBody);
CHECKPOINT;
return(STATUS_ACCESS_DENIED);
}
Show replies by date