[ros-diffs] [janderwald] 39956: - Check if handle is re-used. Fixes double-freeing of handle & crash

[janderwald at svn.reactos.org]

Author: janderwald
Date: Wed Mar 11 21:32:32 2009
New Revision: 39956

URL: http://svn.reactos.org/svn/reactos?rev=39956&view=rev
Log:
- Check if handle is re-used. Fixes double-freeing of handle & crash

Modified:
    trunk/reactos/drivers/wdm/audio/legacy/wdmaud/control.c

Modified: trunk/reactos/drivers/wdm/audio/legacy/wdmaud/control.c
URL: http://svn.reactos.org/svn/reactos/trunk/reactos/drivers/wdm/audio/legacy/wdmaud/control.c?rev=39956&r1=39955&r2=39956&view=diff
==============================================================================
--- trunk/reactos/drivers/wdm/audio/legacy/wdmaud/control.c [iso-8859-1] (original)
+++ trunk/reactos/drivers/wdm/audio/legacy/wdmaud/control.c [iso-8859-1] Wed Mar 11 21:32:32 2009
@@ -137,7 +137,7 @@
     ACCESS_MASK DesiredAccess = 0;
     HANDLE PinHandle;
     KSPIN_CONNECT * PinConnect;
-    ULONG Length;
+    ULONG Length, Index;
     KSDATAFORMAT_WAVEFORMATEX * DataFormat;
     ULONG FilterId;
     ULONG PinId;
@@ -235,7 +235,20 @@
     Status = KsSynchronousIoControlDevice(ClientInfo->FileObject, KernelMode, IOCTL_KS_PROPERTY, (PVOID)InstanceInfo, Length, &PinHandle, sizeof(HANDLE), &BytesReturned);
     if (NT_SUCCESS(Status))
     {
-        PHANDLE Handels = ExAllocatePool(NonPagedPool, sizeof(HANDLE) * (ClientInfo->NumPins+1));
+        PHANDLE Handels;
+
+        for(Index = 0; Index < ClientInfo->NumPins; Index++)
+        {
+            if (ClientInfo->hPins[Index] == PinHandle)
+            {
+                /* the pin handle has been re-used */
+                DeviceInfo->hDevice = PinHandle;
+                return SetIrpIoStatus(Irp, Status, sizeof(WDMAUD_DEVICE_INFO));
+            }
+
+        }
+
+        Handels = ExAllocatePool(NonPagedPool, sizeof(HANDLE) * (ClientInfo->NumPins+1));
 
         if (Handels)
         {