From d6f68397cf8db68d78be137b34f868f2f98a2254 Mon Sep 17 00:00:00 2001
From: Copilot <198982749+Copilot@users.noreply.github.com>
Date: Sat, 27 Dec 2025 22:10:44 +0900
Subject: [PATCH] [WINLOGON] Fix memory and handle leaks (#8514)

JIRA issue: CORE-13213
---
 base/system/winlogon/winlogon.c |  3 +++
 base/system/winlogon/wlx.c      | 34 ++++++++++++++-------------------
 2 files changed, 17 insertions(+), 20 deletions(-)

diff --git a/base/system/winlogon/winlogon.c b/base/system/winlogon/winlogon.c
index 073ef1ee921..f19036dfca0 100644
--- a/base/system/winlogon/winlogon.c
+++ b/base/system/winlogon/winlogon.c
@@ -217,6 +217,7 @@ UpdateTcpIpInformation(VOID)
         else
         {
             ERR("WL: Could not reallocate memory for pszBuffer\n");
+            goto Quit;
         }
     }
     if ((lError == ERROR_SUCCESS) && (dwType == REG_SZ))
@@ -278,6 +279,7 @@ UpdateTcpIpInformation(VOID)
         else
         {
             ERR("WL: Could not reallocate memory for pszBuffer\n");
+            goto Quit;
         }
     }
     if ((lError == ERROR_SUCCESS) && (dwType == REG_SZ))
@@ -297,6 +299,7 @@ UpdateTcpIpInformation(VOID)
     if (pszBuffer != szBuffer)
         HeapFree(GetProcessHeap(), 0, pszBuffer);
 
+Quit:
     RegCloseKey(hKey);
 }
 
diff --git a/base/system/winlogon/wlx.c b/base/system/winlogon/wlx.c
index 3a27b051986..6da9ad7f2aa 100644
--- a/base/system/winlogon/wlx.c
+++ b/base/system/winlogon/wlx.c
@@ -957,10 +957,10 @@ CreateWindowStationAndDesktops(
     SECURITY_ATTRIBUTES ApplicationDesktopSecurity;
     SECURITY_ATTRIBUTES WinlogonDesktopSecurity;
     SECURITY_ATTRIBUTES ScreenSaverDesktopSecurity;
-    PSECURITY_DESCRIPTOR WlWinstaSecurityDescriptor;
-    PSECURITY_DESCRIPTOR WlApplicationDesktopSecurityDescriptor;
-    PSECURITY_DESCRIPTOR WlWinlogonDesktopSecurityDescriptor;
-    PSECURITY_DESCRIPTOR WlScreenSaverDesktopSecurityDescriptor;
+    PSECURITY_DESCRIPTOR WlWinstaSecurityDescriptor = NULL;
+    PSECURITY_DESCRIPTOR WlApplicationDesktopSecurityDescriptor = NULL;
+    PSECURITY_DESCRIPTOR WlWinlogonDesktopSecurityDescriptor = NULL;
+    PSECURITY_DESCRIPTOR WlScreenSaverDesktopSecurityDescriptor = NULL;
     BOOL ret = FALSE;
 
     if (!CreateWinstaSecurity(&WlWinstaSecurityDescriptor))
@@ -1110,23 +1110,17 @@ cleanup:
             CloseWindowStation(Session->InteractiveWindowStation);
             Session->InteractiveWindowStation = NULL;
         }
-        if (WlWinstaSecurityDescriptor)
-        {
-            RtlFreeHeap(RtlGetProcessHeap(), 0, WlWinstaSecurityDescriptor);
-        }
-        if (WlApplicationDesktopSecurityDescriptor)
-        {
-            RtlFreeHeap(RtlGetProcessHeap(), 0, WlApplicationDesktopSecurityDescriptor);
-        }
-        if (WlWinlogonDesktopSecurityDescriptor)
-        {
-            RtlFreeHeap(RtlGetProcessHeap(), 0, WlWinlogonDesktopSecurityDescriptor);
-        }
-        if (WlScreenSaverDesktopSecurityDescriptor)
-        {
-            RtlFreeHeap(RtlGetProcessHeap(), 0, WlScreenSaverDesktopSecurityDescriptor);
-        }
     }
 
+    /* Free security descriptors regardless of success or failure */
+    if (WlWinstaSecurityDescriptor)
+        RtlFreeHeap(RtlGetProcessHeap(), 0, WlWinstaSecurityDescriptor);
+    if (WlApplicationDesktopSecurityDescriptor)
+        RtlFreeHeap(RtlGetProcessHeap(), 0, WlApplicationDesktopSecurityDescriptor);
+    if (WlWinlogonDesktopSecurityDescriptor)
+        RtlFreeHeap(RtlGetProcessHeap(), 0, WlWinlogonDesktopSecurityDescriptor);
+    if (WlScreenSaverDesktopSecurityDescriptor)
+        RtlFreeHeap(RtlGetProcessHeap(), 0, WlScreenSaverDesktopSecurityDescriptor);
+
     return ret;
 }