From c59e2d20d9c8a42f3c94403282efcab1cbe20fd9 Mon Sep 17 00:00:00 2001 From: Oleg Dubinskiy Date: Mon, 26 Aug 2024 11:16:49 +0200 Subject: [PATCH] [NTOS:FSRTL] Check for the correct return status when inserting a new Filter Context entry According to our declaration/definition, IoChangeFileObjectFilerContext returns NTSTATUS, not BOOLEAN. Zero return (which was actually checked before) for BOOLEAN means failure, but for NTSTATUS it's success. So it should (and now actually does) free and fail appropriately only in failure case, but not in success, when it shouldn't. This fixes most of problems with fltmgr.sys driver from Windows XP/Server 2003 and a lot of 3rd party filter drivers which use it from many apps (Avast Free Antivirus all versions, Avira AntiVir Personal 8.2, Dr. Web Security Space 8.0, Kaspersky Antivirus 2012 etc. etc.). CORE-14157, CORE-14635, CORE-19318 --- ntoskrnl/fsrtl/filtrctx.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/ntoskrnl/fsrtl/filtrctx.c b/ntoskrnl/fsrtl/filtrctx.c index 9bd616fad7a..a71475a93bc 100644 --- a/ntoskrnl/fsrtl/filtrctx.c +++ b/ntoskrnl/fsrtl/filtrctx.c @@ -176,6 +176,7 @@ FsRtlInsertPerFileObjectContext(IN PFILE_OBJECT FileObject, IN PFSRTL_PER_FILEOBJECT_CONTEXT Ptr) { PFILE_OBJECT_FILTER_CONTEXTS FOContext = NULL; + NTSTATUS Status; if (!FileObject) { @@ -203,7 +204,8 @@ FsRtlInsertPerFileObjectContext(IN PFILE_OBJECT FileObject, InitializeListHead(&(FOContext->FilterContexts)); /* Set it */ - if (!IoChangeFileObjectFilterContext(FileObject, FOContext, TRUE)) + Status = IoChangeFileObjectFilterContext(FileObject, FOContext, TRUE); + if (!NT_SUCCESS(Status)) { /* If it fails, it means that someone else has set it in the meanwhile */ ExFreePoolWithTag(FOContext, 'FOCX');