Mirrors/hidden
6
0
Fork 0
mirror of https://github.com/JKornev/hidden synced 2024-06-24 07:58:04 +00:00
Code Issues Projects Releases Wiki Activity

Memory leak fixes (Verifier tests)

Browse Source
This commit is contained in:
JKornev 2017-01-29 18:43:20 +03:00
parent d5db2383e7
commit ca63ce3d31
3 changed files with 39 additions and 26 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
Hidden/Configs.c
View File

@ -15,7 +15,7 @@ typedef struct _HidConfigContext {
PHidConfigContext g_configContext = NULL; PHidConfigContext g_configContext = NULL;
NTSTATUS ReleaseConfigContext(PHidConfigContext context); VOID ReleaseConfigContext(PHidConfigContext context);
NTSTATUS GetRegistryDWORD(HANDLE hKey, LPCWSTR Value, PULONG Data, ULONG Default); NTSTATUS GetRegistryDWORD(HANDLE hKey, LPCWSTR Value, PULONG Data, ULONG Default);
NTSTATUS QueryAndAllocRegistryData(HANDLE hKey, LPCWSTR Value, ULONG Type, PUNICODE_STRING Data, PUNICODE_STRING Default); NTSTATUS QueryAndAllocRegistryData(HANDLE hKey, LPCWSTR Value, ULONG Type, PUNICODE_STRING Data, PUNICODE_STRING Default);
@ -79,7 +79,10 @@ NTSTATUS DestroyConfigs()
if (!g_configContext) if (!g_configContext)
return STATUS_NOT_FOUND; return STATUS_NOT_FOUND;
return ReleaseConfigContext(g_configContext); ReleaseConfigContext(g_configContext);
ExFreePoolWithTag(g_configContext, CONFIG_ALLOC_TAG);
return STATUS_SUCCESS;
} }
// ========================================================================================= // =========================================================================================
@ -168,7 +171,7 @@ NTSTATUS CfgEnumConfigsTable(enum CfgMultiStringTables Table, CfgMultiStringCall
// ========================================================================================= // =========================================================================================
NTSTATUS ReleaseConfigContext(PHidConfigContext context) VOID ReleaseConfigContext(PHidConfigContext context)
{ {
ReleaseRegistryData(&context->hideFSDirs); ReleaseRegistryData(&context->hideFSDirs);
ReleaseRegistryData(&context->hideFSFiles); ReleaseRegistryData(&context->hideFSFiles);
@ -176,8 +179,6 @@ NTSTATUS ReleaseConfigContext(PHidConfigContext context)
ReleaseRegistryData(&context->hideRegValues); ReleaseRegistryData(&context->hideRegValues);
ReleaseRegistryData(&context->ignoreImages); ReleaseRegistryData(&context->ignoreImages);
ReleaseRegistryData(&context->protectImages); ReleaseRegistryData(&context->protectImages);
return STATUS_SUCCESS;
} }
NTSTATUS GetRegistryDWORD(HANDLE hKey, LPCWSTR Value, PULONG Data, ULONG Default) NTSTATUS GetRegistryDWORD(HANDLE hKey, LPCWSTR Value, PULONG Data, ULONG Default)

2
Hidden/Helper.c
View File

@ -149,6 +149,7 @@ NTSTATUS NormalizeDevicePath(PCUNICODE_STRING Path, PUNICODE_STRING Normalized)
subPath.Buffer = Path->Buffer; subPath.Buffer = Path->Buffer;
subPath.Length += globalPrefix.Length; subPath.Length += globalPrefix.Length;
subPath.MaximumLength = subPath.Length;
// Open symlink // Open symlink
@ -173,6 +174,7 @@ NTSTATUS NormalizeDevicePath(PCUNICODE_STRING Path, PUNICODE_STRING Normalized)
subPath.Buffer = (PWCH)((PUCHAR)Path->Buffer + subPath.Length); subPath.Buffer = (PWCH)((PUCHAR)Path->Buffer + subPath.Length);
subPath.Length = Path->Length - subPath.Length; subPath.Length = Path->Length - subPath.Length;
subPath.MaximumLength = subPath.Length;
status = RtlAppendUnicodeStringToString(Normalized, &subPath); status = RtlAppendUnicodeStringToString(Normalized, &subPath);
if (!NT_SUCCESS(status)) if (!NT_SUCCESS(status))

52
Hidden/PsRules.c
View File

@ -10,8 +10,8 @@ typedef struct _PsRulesInternalContext {
RTL_GENERIC_COMPARE_RESULTS ComparePsRuleEntry(struct _RTL_AVL_TABLE *Table, PVOID FirstStruct, PVOID SecondStruct) RTL_GENERIC_COMPARE_RESULTS ComparePsRuleEntry(struct _RTL_AVL_TABLE *Table, PVOID FirstStruct, PVOID SecondStruct)
{ {
PPsRuleEntry first = (PPsRuleEntry)FirstStruct; PPsRuleEntry first = *(PPsRuleEntry*)FirstStruct;
PPsRuleEntry second = (PPsRuleEntry)SecondStruct; PPsRuleEntry second = *(PPsRuleEntry*)SecondStruct;
INT res; INT res;
UNREFERENCED_PARAMETER(Table); UNREFERENCED_PARAMETER(Table);
@ -35,7 +35,9 @@ PVOID AllocatePsRuleEntry(struct _RTL_AVL_TABLE *Table, CLONG ByteSize)
VOID FreePsRuleEntry(struct _RTL_AVL_TABLE *Table, PVOID Buffer) VOID FreePsRuleEntry(struct _RTL_AVL_TABLE *Table, PVOID Buffer)
{ {
//PVOID entry = *(PVOID*)Buffer;
UNREFERENCED_PARAMETER(Table); UNREFERENCED_PARAMETER(Table);
//ExFreePoolWithTag(entry, PSRULE_ALLOC_TAG);
ExFreePoolWithTag(Buffer, PSRULE_ALLOC_TAG); ExFreePoolWithTag(Buffer, PSRULE_ALLOC_TAG);
} }
@ -99,7 +101,7 @@ NTSTATUS AddRuleToPsRuleList(PsRulesContext RuleContext, PUNICODE_STRING ImgPath
ExAcquireFastMutex(&context->tableLock); ExAcquireFastMutex(&context->tableLock);
guid = context->idCounter++; guid = context->idCounter++;
entry->guid = guid; entry->guid = guid;
buf = RtlInsertElementGenericTableAvl(&context->table, entry, entryLen, &newElem); buf = RtlInsertElementGenericTableAvl(&context->table, &entry, sizeof(&entry)/*entryLen*/, &newElem);
ExReleaseFastMutex(&context->tableLock); ExReleaseFastMutex(&context->tableLock);
if (!buf) if (!buf)
@ -122,19 +124,22 @@ NTSTATUS RemoveRuleFromPsRuleList(PsRulesContext RuleContext, PsRuleEntryId Entr
{ {
PPsRulesInternalContext context = (PPsRulesInternalContext)RuleContext; PPsRulesInternalContext context = (PPsRulesInternalContext)RuleContext;
NTSTATUS status = STATUS_NOT_FOUND; NTSTATUS status = STATUS_NOT_FOUND;
PPsRuleEntry entry; PPsRuleEntry entry, *pentry;
PVOID restartKey = NULL; PVOID restartKey = NULL;
ExAcquireFastMutex(&context->tableLock); ExAcquireFastMutex(&context->tableLock);
for (entry = RtlEnumerateGenericTableWithoutSplayingAvl(&context->table, &restartKey); for (pentry = RtlEnumerateGenericTableWithoutSplayingAvl(&context->table, &restartKey);
entry != NULL; pentry != NULL;
entry = RtlEnumerateGenericTableWithoutSplayingAvl(&context->table, &restartKey)) pentry = RtlEnumerateGenericTableWithoutSplayingAvl(&context->table, &restartKey))
{ {
entry = *pentry;
if (entry->guid == EntryId) if (entry->guid == EntryId)
{ {
if (!RtlDeleteElementGenericTableAvl(&context->table, entry)) if (!RtlDeleteElementGenericTableAvl(&context->table, pentry))
DbgPrint("FsFilter1!" __FUNCTION__ ": can't remove element from process rules table, looks like memory leak\n"); DbgPrint("FsFilter1!" __FUNCTION__ ": can't remove element from process rules table, looks like memory leak\n");
else
ExFreePoolWithTag(entry, PSRULE_ALLOC_TAG);
status = STATUS_SUCCESS; status = STATUS_SUCCESS;
break; break;
@ -150,17 +155,20 @@ NTSTATUS RemoveAllRulesFromPsRuleList(PsRulesContext RuleContext)
{ {
PPsRulesInternalContext context = (PPsRulesInternalContext)RuleContext; PPsRulesInternalContext context = (PPsRulesInternalContext)RuleContext;
NTSTATUS status = STATUS_SUCCESS; NTSTATUS status = STATUS_SUCCESS;
PPsRuleEntry entry; PPsRuleEntry entry, *pentry;
PVOID restartKey = NULL; PVOID restartKey = NULL;
ExAcquireFastMutex(&context->tableLock); ExAcquireFastMutex(&context->tableLock);
for (entry = RtlEnumerateGenericTableWithoutSplayingAvl(&context->table, &restartKey); for (pentry = RtlEnumerateGenericTableWithoutSplayingAvl(&context->table, &restartKey);
entry != NULL; pentry != NULL;
entry = RtlEnumerateGenericTableWithoutSplayingAvl(&context->table, &restartKey)) pentry = RtlEnumerateGenericTableWithoutSplayingAvl(&context->table, &restartKey))
{ {
if (!RtlDeleteElementGenericTableAvl(&context->table, entry)) entry = *pentry;
if (!RtlDeleteElementGenericTableAvl(&context->table, pentry))
DbgPrint("FsFilter1!" __FUNCTION__ ": can't remove element from process rules table, looks like memory leak\n"); DbgPrint("FsFilter1!" __FUNCTION__ ": can't remove element from process rules table, looks like memory leak\n");
else
ExFreePoolWithTag(entry, PSRULE_ALLOC_TAG);
restartKey = NULL; // reset enum restartKey = NULL; // reset enum
} }
@ -174,15 +182,16 @@ NTSTATUS CheckInPsRuleList(PsRulesContext RuleContext, PCUNICODE_STRING ImgPath,
{ {
PPsRulesInternalContext context = (PPsRulesInternalContext)RuleContext; PPsRulesInternalContext context = (PPsRulesInternalContext)RuleContext;
NTSTATUS status = STATUS_NOT_FOUND; NTSTATUS status = STATUS_NOT_FOUND;
PPsRuleEntry entry; PPsRuleEntry entry, *pentry;
PVOID restartKey = NULL; PVOID restartKey = NULL;
ExAcquireFastMutex(&context->tableLock); ExAcquireFastMutex(&context->tableLock);
for (entry = RtlEnumerateGenericTableWithoutSplayingAvl(&context->table, &restartKey); for (pentry = RtlEnumerateGenericTableWithoutSplayingAvl(&context->table, &restartKey);
entry != NULL; pentry != NULL;
entry = RtlEnumerateGenericTableWithoutSplayingAvl(&context->table, &restartKey)) pentry = RtlEnumerateGenericTableWithoutSplayingAvl(&context->table, &restartKey))
{ {
entry = *pentry;
if (RtlCompareUnicodeString(&entry->imagePath, ImgPath, TRUE) == 0) if (RtlCompareUnicodeString(&entry->imagePath, ImgPath, TRUE) == 0)
{ {
*OutSize = entry->len; *OutSize = entry->len;
@ -207,16 +216,17 @@ NTSTATUS CheckInPsRuleList(PsRulesContext RuleContext, PCUNICODE_STRING ImgPath,
BOOLEAN FindInheritanceInPsRuleList(PsRulesContext RuleContext, PCUNICODE_STRING ImgPath, PULONG pInheritance) BOOLEAN FindInheritanceInPsRuleList(PsRulesContext RuleContext, PCUNICODE_STRING ImgPath, PULONG pInheritance)
{ {
PPsRulesInternalContext context = (PPsRulesInternalContext)RuleContext; PPsRulesInternalContext context = (PPsRulesInternalContext)RuleContext;
PPsRuleEntry entry; PPsRuleEntry entry, *pentry;
PVOID restartKey = NULL; PVOID restartKey = NULL;
BOOLEAN result = FALSE; BOOLEAN result = FALSE;
ExAcquireFastMutex(&context->tableLock); ExAcquireFastMutex(&context->tableLock);
for (entry = RtlEnumerateGenericTableWithoutSplayingAvl(&context->table, &restartKey); for (pentry = RtlEnumerateGenericTableWithoutSplayingAvl(&context->table, &restartKey);
entry != NULL; pentry != NULL;
entry = RtlEnumerateGenericTableWithoutSplayingAvl(&context->table, &restartKey)) pentry = RtlEnumerateGenericTableWithoutSplayingAvl(&context->table, &restartKey))
{ {
entry = *pentry;
if (RtlCompareUnicodeString(&entry->imagePath, ImgPath, TRUE) == 0) if (RtlCompareUnicodeString(&entry->imagePath, ImgPath, TRUE) == 0)
{ {
*pInheritance = entry->inheritType; *pInheritance = entry->inheritType;