[cgutman] 63899: [TCPIP] - Reference the address file while delivering data to avoid a use after free when an address file is closed during datagram delivery

Author: cgutman
Date: Sun Aug 17 04:03:29 2014
New Revision: 63899

URL: http://svn.reactos.org/svn/reactos?rev=63899&view=rev
Log:
[TCPIP]
- Reference the address file while delivering data to avoid a use after free when an address file is closed during datagram delivery

Modified:
    trunk/reactos/drivers/network/tcpip/tcpip/fileobjs.c
    trunk/reactos/lib/drivers/ip/transport/rawip/rawip.c
    trunk/reactos/lib/drivers/ip/transport/udp/udp.c

Modified: trunk/reactos/drivers/network/tcpip/tcpip/fileobjs.c
URL: http://svn.reactos.org/svn/reactos/trunk/reactos/drivers/network/tcpip/tcpip...
==============================================================================
--- trunk/reactos/drivers/network/tcpip/tcpip/fileobjs.c	[iso-8859-1] (original)
+++ trunk/reactos/drivers/network/tcpip/tcpip/fileobjs.c	[iso-8859-1] Sun Aug 17 04:03:29 2014
@@ -222,7 +222,7 @@
  * ARGUMENTS:
  *     SearchContext = Pointer to search context
  * RETURNS:
- *     Pointer to address file, NULL if none was found
+ *     Pointer to referenced address file, NULL if none was found
  */
 PADDRESS_FILE AddrSearchNext(
     PAF_SEARCH SearchContext)
@@ -232,6 +232,7 @@
     KIRQL OldIrql;
     PADDRESS_FILE Current = NULL;
     BOOLEAN Found = FALSE;
+    PADDRESS_FILE StartingAddrFile;

TcpipAcquireSpinLock(&AddressFileListLock, &OldIrql);

@@ -241,8 +242,8 @@
         return NULL;
     }

-    /* Remove the extra reference we added to keep this address file in memory */
-    DereferenceObject(CONTAINING_RECORD(SearchContext->Next, ADDRESS_FILE, ListEntry));
+    /* Save this pointer so we can dereference it later */
+    StartingAddrFile = CONTAINING_RECORD(SearchContext->Next, ADDRESS_FILE, ListEntry);

CurrentEntry = SearchContext->Next;

@@ -279,9 +280,15 @@
             /* Reference the next address file to prevent the link from disappearing behind our back */
             ReferenceObject(CONTAINING_RECORD(SearchContext->Next, ADDRESS_FILE, ListEntry));
         }
+
+        /* Reference the returned address file before dereferencing the starting
+         * address file because it may be that Current == StartingAddrFile */
+        ReferenceObject(Current);
     }
     else
         Current = NULL;
+
+    DereferenceObject(StartingAddrFile);

TcpipReleaseSpinLock(&AddressFileListLock, OldIrql);

Modified: trunk/reactos/lib/drivers/ip/transport/rawip/rawip.c
URL: http://svn.reactos.org/svn/reactos/trunk/reactos/lib/drivers/ip/transport/ra...
==============================================================================
--- trunk/reactos/lib/drivers/ip/transport/rawip/rawip.c	[iso-8859-1] (original)
+++ trunk/reactos/lib/drivers/ip/transport/rawip/rawip.c	[iso-8859-1] Sun Aug 17 04:03:29 2014
@@ -321,6 +321,7 @@
                     0,
                     IPPacket,
                     DataSize);
+      DereferenceObject(AddrFile);
     } while ((AddrFile = AddrSearchNext(&SearchContext)) != NULL);
   } else {
     /* There are no open address files that will take this datagram */

Modified: trunk/reactos/lib/drivers/ip/transport/udp/udp.c
URL: http://svn.reactos.org/svn/reactos/trunk/reactos/lib/drivers/ip/transport/ud...
==============================================================================
--- trunk/reactos/lib/drivers/ip/transport/udp/udp.c	[iso-8859-1] (original)
+++ trunk/reactos/lib/drivers/ip/transport/udp/udp.c	[iso-8859-1] Sun Aug 17 04:03:29 2014
@@ -320,6 +320,7 @@
    	    UDPHeader->DestPort,
                     IPPacket,
                     DataSize);
+      DereferenceObject(AddrFile);
     } while ((AddrFile = AddrSearchNext(&SearchContext)) != NULL);
   } else {
     /* There are no open address files that will take this datagram */