From 335b3f2e4e73b4247d41371d5204a567c7e326e8 Mon Sep 17 00:00:00 2001
From: Pierre Schweitzer <pierre@reactos.org>
Date: Tue, 2 May 2017 21:32:20 +0000
Subject: [PATCH] [NTOSKNRL] Misc fixes in NtQueryDirectoryFile(): - Don't leak
 auxbuffer - Don't allow two completion routines

svn path=/trunk/; revision=74451
---
 reactos/ntoskrnl/io/iomgr/iofunc.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/reactos/ntoskrnl/io/iomgr/iofunc.c b/reactos/ntoskrnl/io/iomgr/iofunc.c
index eb32a4d715e..5aa67ee3e10 100644
--- a/reactos/ntoskrnl/io/iomgr/iofunc.c
+++ b/reactos/ntoskrnl/io/iomgr/iofunc.c
@@ -1901,6 +1901,14 @@ NtQueryDirectoryFile(IN HANDLE FileHandle,
         return Status;
     }
 
+    /* Are there two associated completion routines? */
+    if (FileObject->CompletionContext != NULL && ApcRoutine != NULL)
+    {
+        ObDereferenceObject(FileObject);
+        if (AuxBuffer) ExFreePoolWithTag(AuxBuffer, TAG_SYSB);
+        return STATUS_INVALID_PARAMETER;
+    }
+
     /* Check if we have an even handle */
     if (EventHandle)
     {
@@ -1914,6 +1922,7 @@ NtQueryDirectoryFile(IN HANDLE FileHandle,
         if (!NT_SUCCESS(Status))
         {
             /* Fail */
+            if (AuxBuffer) ExFreePoolWithTag(AuxBuffer, TAG_SYSB);
             ObDereferenceObject(FileObject);
             return Status;
         }