Akihiro Sagawa : ntdll: Fix use-after-free.
Alexandre Julliard
julliard at winehq.org
Mon Aug 30 15:53:51 CDT 2021
Module: wine
Branch: master
Commit: 8a3e0d686ea4cbff33dc45bb63e71f132c22797a
URL: https://source.winehq.org/git/wine.git/?a=commit;h=8a3e0d686ea4cbff33dc45bb63e71f132c22797a
Author: Akihiro Sagawa <sagawa.aki at gmail.com>
Date: Sun Aug 29 21:35:14 2021 +0900
ntdll: Fix use-after-free.
Fixes a regression introduced by 76f949577aac88bbde4e9e7b904587f5bc8c808d.
nt_name or redir is used in open_unix_file() because attr.ObjectName
points to either of them.
Wine-Bug: https://bugs.winehq.org/show_bug.cgi?id=51702
Signed-off-by: Akihiro Sagawa <sagawa.aki at gmail.com>
Signed-off-by: Alexandre Julliard <julliard at winehq.org>
---
dlls/ntdll/unix/process.c | 10 ++++++----
1 file changed, 6 insertions(+), 4 deletions(-)
diff --git a/dlls/ntdll/unix/process.c b/dlls/ntdll/unix/process.c
index d7f3edf4330..f5b8b5315cd 100644
--- a/dlls/ntdll/unix/process.c
+++ b/dlls/ntdll/unix/process.c
@@ -368,16 +368,18 @@ static int get_unix_curdir( const RTL_USER_PROCESS_PARAMETERS *params )
InitializeObjectAttributes( &attr, &nt_name, OBJ_CASE_INSENSITIVE, 0, NULL );
get_redirect( &attr, &redir );
status = nt_to_unix_file_name( &attr, &unix_name, FILE_OPEN );
- free( nt_name.Buffer );
- free( redir.Buffer );
- if (status) return -1;
+ if (status) goto done;
status = open_unix_file( &handle, unix_name, FILE_TRAVERSE | SYNCHRONIZE, &attr, 0,
FILE_SHARE_READ | FILE_SHARE_DELETE,
FILE_OPEN, FILE_SYNCHRONOUS_IO_NONALERT, NULL, 0 );
free( unix_name );
- if (status) return -1;
+ if (status) goto done;
wine_server_handle_to_fd( handle, FILE_TRAVERSE, &fd, NULL );
NtClose( handle );
+
+done:
+ free( nt_name.Buffer );
+ free( redir.Buffer );
return fd;
}
More information about the wine-cvs
mailing list