From: Dmitry Chapyshev <dmitry@reactos.org>
Date: Sat, 3 Sep 2016 15:49:55 +0000 (+0000)
Subject: [NTOS:IO]
X-Git-Tag: backups/sndblst@72664~112
X-Git-Url: https://git.reactos.org/?p=reactos.git;a=commitdiff_plain;h=212b70142ca062dec95a5965226d25f6bd6904b8

[NTOS:IO]
- Fix potential null-pointer dereferencing (we call IopCleanupAfterException in IopDeviceFsIoControl with Irp == NULL)

svn path=/trunk/; revision=72548
---

diff --git a/reactos/ntoskrnl/io/iomgr/iofunc.c b/reactos/ntoskrnl/io/iomgr/iofunc.c
index 5da953be654..07dc8ce4ef8 100644
--- a/reactos/ntoskrnl/io/iomgr/iofunc.c
+++ b/reactos/ntoskrnl/io/iomgr/iofunc.c
@@ -22,25 +22,28 @@
 VOID
 NTAPI
 IopCleanupAfterException(IN PFILE_OBJECT FileObject,
-                         IN PIRP Irp,
+                         IN PIRP Irp OPTIONAL,
                          IN PKEVENT Event OPTIONAL,
                          IN PKEVENT LocalEvent OPTIONAL)
 {
     PAGED_CODE();
     IOTRACE(IO_API_DEBUG, "IRP: %p. FO: %p \n", Irp, FileObject);
 
-    /* Check if we had a buffer */
-    if (Irp->AssociatedIrp.SystemBuffer)
+    if (Irp)
     {
-        /* Free it */
-        ExFreePool(Irp->AssociatedIrp.SystemBuffer);
-    }
+        /* Check if we had a buffer */
+        if (Irp->AssociatedIrp.SystemBuffer)
+        {
+            /* Free it */
+            ExFreePool(Irp->AssociatedIrp.SystemBuffer);
+        }
 
-    /* Free the mdl */
-    if (Irp->MdlAddress) IoFreeMdl(Irp->MdlAddress);
+        /* Free the mdl */
+        if (Irp->MdlAddress) IoFreeMdl(Irp->MdlAddress);
 
-    /* Free the IRP */
-    IoFreeIrp(Irp);
+        /* Free the IRP */
+        IoFreeIrp(Irp);
+    }
 
     /* Check if we had a file lock */
     if (FileObject->Flags & FO_SYNCHRONOUS_IO)