From ae25dcdf0fada04e8d4dec3f1804f94f1f614e89 Mon Sep 17 00:00:00 2001
From: Ged Murphy <gedmurphy@reactos.org>
Date: Sat, 27 May 2006 15:06:51 +0000
Subject: [PATCH] Fix possible memory leak in ProbeAndCaptureUnicodeString
 Patch from Thomas Weidenmueller

svn path=/trunk/; revision=22078
---
 reactos/include/reactos/probe.h | 14 ++++++++++++--
 1 file changed, 12 insertions(+), 2 deletions(-)

diff --git a/reactos/include/reactos/probe.h b/reactos/include/reactos/probe.h
index ceebc4c4a51..742b4a096c5 100644
--- a/reactos/include/reactos/probe.h
+++ b/reactos/include/reactos/probe.h
@@ -31,7 +31,7 @@ VOID NTAPI W32kRaiseStatus(NTSTATUS Status);
 
 #define ProbeForWriteBoolean(Ptr) ProbeForWriteGenericType(Ptr, BOOLEAN)
 #define ProbeForWriteUchar(Ptr) ProbeForWriteGenericType(Ptr, UCHAR)
-#define ProbeForWriteChar(Ptr) ProbeForWriteGenericType(Ptr, Char)
+#define ProbeForWriteChar(Ptr) ProbeForWriteGenericType(Ptr, CHAR)
 #define ProbeForWriteUshort(Ptr) ProbeForWriteGenericType(Ptr, USHORT)
 #define ProbeForWriteShort(Ptr) ProbeForWriteGenericType(Ptr, SHORT)
 #define ProbeForWriteUlong(Ptr) ProbeForWriteGenericType(Ptr, ULONG)
@@ -85,7 +85,7 @@ ProbeAndCaptureUnicodeString(OUT PUNICODE_STRING Dest,
                              IN PUNICODE_STRING UnsafeSrc)
 {
     NTSTATUS Status = STATUS_SUCCESS;
-    WCHAR *Buffer;
+    WCHAR *Buffer = NULL;
     ASSERT(Dest != NULL);
 
     /* Probe the structure and buffer*/
@@ -136,6 +136,16 @@ ProbeAndCaptureUnicodeString(OUT PUNICODE_STRING Dest,
         }
         _SEH_HANDLE
         {
+            /* Free allocated resources and zero the destination string */
+            if (Buffer != NULL)
+            {
+                ExFreePool(Buffer);
+            }
+            Dest->Length = 0;
+            Dest->MaximumLength = 0;
+            Dest->Buffer = NULL;
+
+            /* Return the error code */
             Status = _SEH_GetExceptionCode();
         }
         _SEH_END;