diff options
| author | Yuri Benditovich <yuri.benditovich@daynix.com> | 2020-01-01 15:05:16 +0200 |
|---|---|---|
| committer | Yan Vugenfirer <yan@daynix.com> | 2020-01-02 21:47:41 +0200 |
| commit | 65f7251d2c02e4f9bd51a92b9de1e298969c981c (patch) | |
| tree | ce74374fc944f78c058b8407c511e9ceb8a67b24 | |
| parent | 7c93e05e607f593fab8812ce03cc79dda43fc819 (diff) | |
driver: prevent access to already deleted object
https://github.com/daynix/UsbDk/issues/81
If during redirection the redirection object is deleted
we may try accessing the deleted object in the loop of
attempts to create the redirection handle.
To avoid this we reference the redirection object until
the redirection request completely satisfied or failed.
Signed-off-by: Yuri Benditovich <yuri.benditovich@daynix.com>
| -rw-r--r-- | UsbDk/ControlDevice.cpp | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/UsbDk/ControlDevice.cpp b/UsbDk/ControlDevice.cpp index 1339461..49097f7 100644 --- a/UsbDk/ControlDevice.cpp +++ b/UsbDk/ControlDevice.cpp @@ -731,6 +731,8 @@ NTSTATUS CUsbDkControlDevice::AddRedirect(const USB_DK_DEVICE_ID &DeviceId, HAND { return addRes; } + Redirection->AddRef(); + CObjHolder<CUsbDkRedirection, CRefCountingDeleter> dereferencer(Redirection); TraceEvents(TRACE_LEVEL_INFORMATION, TRACE_CONTROLDEVICE, "%!FUNC! Success. New redirections list:"); m_Redirections.Dump(); @@ -1198,6 +1200,12 @@ NTSTATUS CUsbDkRedirection::CreateRedirectorHandle(HANDLE RequestorProcess, PHAN do { + if (IsPreparedForRemove()) + { + TraceEvents(TRACE_LEVEL_INFORMATION, TRACE_WDFDEVICE, "%!FUNC!: device already marked for removal"); + status = STATUS_DEVICE_REMOVED; + break; + } status = m_RedirectorDevice->CreateUserModeHandle(RequestorProcess, ObjectHandle); if (NT_SUCCESS(status)) { |