[KERNEL32]

Avoid an use-after-free in GetVolumeNameForRoot()

svn path=/trunk/; revision=76027

diff --git a/reactos/dll/win32/kernel32/client/file/mntpoint.c b/reactos/dll/win32/kernel32/client/file/mntpoint.c
index 9e31a46..9cd3dd3 100644 (file)
--- a/reactos/dll/win32/kernel32/client/file/mntpoint.c
+++ b/reactos/dll/win32/kernel32/client/file/mntpoint.c
@@ -121,12 +121,12 @@ GetVolumeNameForRoot(IN LPCWSTR lpszRootPath,
     MountPoint->DeviceNameOffset = sizeof(MOUNTMGR_MOUNT_POINT);
     MountPoint->DeviceNameLength = NtPathName.Length;
     RtlCopyMemory((PVOID)((ULONG_PTR)MountPoint + sizeof(MOUNTMGR_MOUNT_POINT)), NtPathName.Buffer, NtPathName.Length);
     MountPoint->DeviceNameOffset = sizeof(MOUNTMGR_MOUNT_POINT);
     MountPoint->DeviceNameLength = NtPathName.Length;
     RtlCopyMemory((PVOID)((ULONG_PTR)MountPoint + sizeof(MOUNTMGR_MOUNT_POINT)), NtPathName.Buffer, NtPathName.Length);

-    RtlFreeHeap(RtlGetProcessHeap(), 0, NtPathName.Buffer);

 
     /* Allocate a dummy output buffer to probe for size */
     MountPoints = RtlAllocateHeap(RtlGetProcessHeap(), 0, sizeof(MOUNTMGR_MOUNT_POINTS));
     if (MountPoints == NULL)
     {
 
     /* Allocate a dummy output buffer to probe for size */
     MountPoints = RtlAllocateHeap(RtlGetProcessHeap(), 0, sizeof(MOUNTMGR_MOUNT_POINTS));
     if (MountPoints == NULL)
     {

+        RtlFreeHeap(RtlGetProcessHeap(), 0, NtPathName.Buffer);

         RtlFreeHeap(RtlGetProcessHeap(), 0, MountPoint);
         SetLastError(ERROR_NOT_ENOUGH_MEMORY);
         return FALSE;
         RtlFreeHeap(RtlGetProcessHeap(), 0, MountPoint);
         SetLastError(ERROR_NOT_ENOUGH_MEMORY);
         return FALSE;


@@ -139,6 +139,7 @@ GetVolumeNameForRoot(IN LPCWSTR lpszRootPath,
                                  INVALID_HANDLE_VALUE);
     if (MountMgrHandle == INVALID_HANDLE_VALUE)
     {
                                  INVALID_HANDLE_VALUE);
     if (MountMgrHandle == INVALID_HANDLE_VALUE)
     {

+        RtlFreeHeap(RtlGetProcessHeap(), 0, NtPathName.Buffer);

         RtlFreeHeap(RtlGetProcessHeap(), 0, MountPoints);
         RtlFreeHeap(RtlGetProcessHeap(), 0, MountPoint);
         return FALSE;
         RtlFreeHeap(RtlGetProcessHeap(), 0, MountPoints);
         RtlFreeHeap(RtlGetProcessHeap(), 0, MountPoint);
         return FALSE;


@@ -162,6 +163,7 @@ GetVolumeNameForRoot(IN LPCWSTR lpszRootPath,
         if (MountPoints == NULL)
         {
             CloseHandle(MountMgrHandle);
         if (MountPoints == NULL)
         {
             CloseHandle(MountMgrHandle);

+            RtlFreeHeap(RtlGetProcessHeap(), 0, NtPathName.Buffer);

             RtlFreeHeap(RtlGetProcessHeap(), 0, MountPoint);
             SetLastError(ERROR_NOT_ENOUGH_MEMORY);
             return FALSE;
             RtlFreeHeap(RtlGetProcessHeap(), 0, MountPoint);
             SetLastError(ERROR_NOT_ENOUGH_MEMORY);
             return FALSE;


@@ -181,6 +183,7 @@ GetVolumeNameForRoot(IN LPCWSTR lpszRootPath,
     /* If the mount manager failed, just quit */
     if (!Ret)
     {
     /* If the mount manager failed, just quit */
     if (!Ret)
     {

+        RtlFreeHeap(RtlGetProcessHeap(), 0, NtPathName.Buffer);

         RtlFreeHeap(RtlGetProcessHeap(), 0, MountPoints);
         SetLastError(ERROR_INVALID_PARAMETER);
         return FALSE;
         RtlFreeHeap(RtlGetProcessHeap(), 0, MountPoints);
         SetLastError(ERROR_INVALID_PARAMETER);
         return FALSE;


@@ -218,6 +221,7 @@ GetVolumeNameForRoot(IN LPCWSTR lpszRootPath,
     /* We couldn't find anything matching, return an error */
     if (CurrentMntPt == MountPoints->NumberOfMountPoints)
     {
     /* We couldn't find anything matching, return an error */
     if (CurrentMntPt == MountPoints->NumberOfMountPoints)
     {

+        RtlFreeHeap(RtlGetProcessHeap(), 0, NtPathName.Buffer);

         RtlFreeHeap(RtlGetProcessHeap(), 0, MountPoints);
         SetLastError(ERROR_INVALID_PARAMETER);
         return FALSE;
         RtlFreeHeap(RtlGetProcessHeap(), 0, MountPoints);
         SetLastError(ERROR_INVALID_PARAMETER);
         return FALSE;


@@ -226,6 +230,7 @@ GetVolumeNameForRoot(IN LPCWSTR lpszRootPath,
     /* We found a matching volume, have we enough memory to return it? */
     if (cchBufferLength * sizeof(WCHAR) < FoundVolumeLen + 2 * sizeof(WCHAR))
     {
     /* We found a matching volume, have we enough memory to return it? */
     if (cchBufferLength * sizeof(WCHAR) < FoundVolumeLen + 2 * sizeof(WCHAR))
     {

+        RtlFreeHeap(RtlGetProcessHeap(), 0, NtPathName.Buffer);

         RtlFreeHeap(RtlGetProcessHeap(), 0, MountPoints);
         SetLastError(ERROR_FILENAME_EXCED_RANGE);
         return FALSE;
         RtlFreeHeap(RtlGetProcessHeap(), 0, MountPoints);
         SetLastError(ERROR_FILENAME_EXCED_RANGE);
         return FALSE;


@@ -240,6 +245,7 @@ GetVolumeNameForRoot(IN LPCWSTR lpszRootPath,
     lpszVolumeName[FoundVolumeLen / sizeof(WCHAR) + 1] = UNICODE_NULL;
 
     /* We're done! */
     lpszVolumeName[FoundVolumeLen / sizeof(WCHAR) + 1] = UNICODE_NULL;
 
     /* We're done! */

+    RtlFreeHeap(RtlGetProcessHeap(), 0, NtPathName.Buffer);

     RtlFreeHeap(RtlGetProcessHeap(), 0, MountPoints);
     return TRUE;
 }
     RtlFreeHeap(RtlGetProcessHeap(), 0, MountPoints);
     return TRUE;
 }