From d658f95e0cb67b0458ef574edaceb753f441b1c6 Mon Sep 17 00:00:00 2001 From: Aleksey Bragin Date: Sun, 31 Aug 2008 16:24:29 +0000 Subject: [PATCH] - Fix two major problems in CmpCleanUpKcbCacheWithLock: * Accessing (reading and writing - corruption!) freed paged pool memory. * Lacking a dereference of a parent key. - Fix a typo in the comment ("reference" -> "dereference"). svn path=/trunk/; revision=35836 --- reactos/ntoskrnl/config/cmkcbncb.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/reactos/ntoskrnl/config/cmkcbncb.c b/reactos/ntoskrnl/config/cmkcbncb.c index 90271a532f2..716cb289205 100644 --- a/reactos/ntoskrnl/config/cmkcbncb.c +++ b/reactos/ntoskrnl/config/cmkcbncb.c @@ -483,7 +483,7 @@ CmpCleanUpKcbCacheWithLock(IN PCM_KEY_CONTROL_BLOCK Kcb, /* Cleanup the value cache */ CmpCleanUpKcbValueCache(Kcb); - /* Reference the NCB */ + /* Dereference the NCB */ CmpDereferenceNameControlBlockWithLock(Kcb->NameBlock); /* Check if we have an index hint block and free it */ @@ -492,10 +492,10 @@ CmpCleanUpKcbCacheWithLock(IN PCM_KEY_CONTROL_BLOCK Kcb, /* Check if we were already deleted */ Parent = Kcb->ParentKcb; if (!Kcb->Delete) CmpRemoveKeyControlBlock(Kcb); - + /* Set invalid KCB signature */ Kcb->Signature = CM_KCB_INVALID_SIGNATURE; - + /* Free the KCB as well */ CmpFreeKeyControlBlock(Kcb); @@ -504,8 +504,8 @@ CmpCleanUpKcbCacheWithLock(IN PCM_KEY_CONTROL_BLOCK Kcb, { /* Dereference the parent */ LockHeldExclusively ? - CmpDereferenceKeyControlBlockWithLock(Kcb,LockHeldExclusively) : - CmpDelayDerefKeyControlBlock(Kcb); + CmpDereferenceKeyControlBlockWithLock(Parent,LockHeldExclusively) : + CmpDelayDerefKeyControlBlock(Parent); } }