https://git.reactos.org/?p=reactos.git;a=commitdiff;h=bc002f17087d912f1148b988299aa523f28e927c
commit bc002f17087d912f1148b988299aa523f28e927c Author: Thomas Faber <[email protected]> AuthorDate: Sat Jan 12 16:25:52 2019 +0100 Commit: Thomas Faber <[email protected]> CommitDate: Sat Jan 12 16:27:37 2019 +0100 [FASTFAT] Avoid a use after free in VfatCloseFile. --- drivers/filesystems/fastfat/close.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/drivers/filesystems/fastfat/close.c b/drivers/filesystems/fastfat/close.c index b6c250f92c..57efdad97a 100644 --- a/drivers/filesystems/fastfat/close.c +++ b/drivers/filesystems/fastfat/close.c @@ -163,6 +163,7 @@ VfatCloseFile( { PVFATFCB pFcb; PVFATCCB pCcb; + BOOLEAN IsVolume; NTSTATUS Status = STATUS_SUCCESS; DPRINT("VfatCloseFile(DeviceExt %p, FileObject %p)\n", @@ -177,6 +178,8 @@ VfatCloseFile( return STATUS_SUCCESS; } + IsVolume = BooleanFlagOn(pFcb->Flags, FCB_IS_VOLUME); + if (pCcb) { vfatDestroyCCB(pCcb); @@ -194,7 +197,7 @@ VfatCloseFile( FileObject->SectionObjectPointer = NULL; #ifdef ENABLE_SWAPOUT - if (BooleanFlagOn(pFcb->Flags, FCB_IS_VOLUME) && DeviceExt->OpenHandleCount == 0) + if (IsVolume && DeviceExt->OpenHandleCount == 0) { VfatCheckForDismount(DeviceExt, FALSE); }
