ReceiveTempSMS
/
Sweden-Number
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

ntdll: Fix use-after-free. 

Fixes a regression introduced by 76f949577a.
nt_name or redir is used in open_unix_file() because attr.ObjectName
points to either of them.

Wine-Bug: https://bugs.winehq.org/show_bug.cgi?id=51702
Signed-off-by: Akihiro Sagawa <sagawa.aki@gmail.com>
Signed-off-by: Alexandre Julliard <julliard@winehq.org>
This commit is contained in:
Akihiro Sagawa 2021-08-29 21:35:14 +09:00 committed by Alexandre Julliard
parent 8756ae3963
commit 8a3e0d686e
1 changed files with 6 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
dlls/ntdll/unix/process.c
View File

@ -368,16 +368,18 @@ static int get_unix_curdir( const RTL_USER_PROCESS_PARAMETERS *params )
InitializeObjectAttributes( &attr, &nt_name, OBJ_CASE_INSENSITIVE, 0, NULL );
get_redirect( &attr, &redir );
status = nt_to_unix_file_name( &attr, &unix_name, FILE_OPEN );
free( nt_name.Buffer );
free( redir.Buffer );
if (status) return -1;
if (status) goto done;
status = open_unix_file( &handle, unix_name, FILE_TRAVERSE | SYNCHRONIZE, &attr, 0,
FILE_SHARE_READ | FILE_SHARE_DELETE,
FILE_OPEN, FILE_SYNCHRONOUS_IO_NONALERT, NULL, 0 );
free( unix_name );
if (status) return -1;
if (status) goto done;
wine_server_handle_to_fd( handle, FILE_TRAVERSE, &fd, NULL );
NtClose( handle );
done:
free( nt_name.Buffer );
free( redir.Buffer );
return fd;
}