[WDMAUD] WdmAudGetDeviceInterface(): fix memory leak and protect the buffer (#9012)

- Fix memory leak in WdmAudGetDeviceInterface() (FreeItem(Device) was not called on STATUS_BUFFER_OVERFLOW early return path).
- Wrap user-mode buffer write in ProbeForWrite() + SEH2().

drivers/wdm/audio/legacy/wdmaud/CMakeLists.txt

@@ -1,4 +1,3 @@
-
 add_definitions(-D_COMDDK_)
 
 include_directories(
@@ -15,7 +14,7 @@ list(APPEND SOURCE
 
 add_library(wdmaud MODULE ${SOURCE} wdmaud.rc)
 set_module_type(wdmaud kernelmodedriver)
-target_link_libraries(wdmaud mmixer libcntpr)
+target_link_libraries(wdmaud mmixer libcntpr pseh)
 add_pch(wdmaud wdmaud.h SOURCE)
 add_importlibs(wdmaud ntoskrnl ks hal)
 add_cd_file(TARGET wdmaud DESTINATION reactos/system32/drivers FOR all)

drivers/wdm/audio/legacy/wdmaud/control.c

@@ -253,12 +253,22 @@ WdmAudGetDeviceInterface(
     {
         /* buffer too small */
         DeviceInfo->u.Interface.DeviceInterfaceStringSize = Length;
+        FreeItem(Device);
         return SetIrpIoStatus(Irp, STATUS_BUFFER_OVERFLOW, sizeof(WDMAUD_DEVICE_INFO));
     }
     else
     {
-        //FIXME SEH
-        RtlMoveMemory(DeviceInfo->u.Interface.DeviceInterfaceString, Device, Length);
+        _SEH2_TRY
+        {
+            ProbeForWrite(DeviceInfo->u.Interface.DeviceInterfaceString, Length, sizeof(WCHAR));
+            RtlMoveMemory(DeviceInfo->u.Interface.DeviceInterfaceString, Device, Length);
+        }
+        _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
+        {
+            FreeItem(Device);
+            return SetIrpIoStatus(Irp, _SEH2_GetExceptionCode(), 0);
+        }
+        _SEH2_END;
     }
 
     FreeItem(Device);

drivers/wdm/audio/legacy/wdmaud/wdmaud.h

@@ -3,6 +3,7 @@
 
 #include <portcls.h>
 #include <mmsystem.h>
+#include <pseh/pseh2.h>
 
 #include "interface.h"