From f800886dc0aad6fc3e479383e54d8fe861e32be3 Mon Sep 17 00:00:00 2001
From: Alex Mendoza <05alex.mendozaa@gmail.com>
Date: Tue, 26 May 2026 19:35:16 +0200
Subject: [PATCH] [WDMAUD] WdmAudGetDeviceInterface(): fix memory leak and
 protect the buffer (#9012)

- Fix memory leak in WdmAudGetDeviceInterface() (FreeItem(Device) was not called on STATUS_BUFFER_OVERFLOW early return path).
- Wrap user-mode buffer write in ProbeForWrite() + SEH2().
---
 drivers/wdm/audio/legacy/wdmaud/CMakeLists.txt |  3 +--
 drivers/wdm/audio/legacy/wdmaud/control.c      | 14 ++++++++++++--
 drivers/wdm/audio/legacy/wdmaud/wdmaud.h       |  1 +
 3 files changed, 14 insertions(+), 4 deletions(-)

diff --git a/drivers/wdm/audio/legacy/wdmaud/CMakeLists.txt b/drivers/wdm/audio/legacy/wdmaud/CMakeLists.txt
index c088ebf6460..f33aacfead1 100644
--- a/drivers/wdm/audio/legacy/wdmaud/CMakeLists.txt
+++ b/drivers/wdm/audio/legacy/wdmaud/CMakeLists.txt
@@ -1,4 +1,3 @@
-
 add_definitions(-D_COMDDK_)
 
 include_directories(
@@ -15,7 +14,7 @@ list(APPEND SOURCE
 
 add_library(wdmaud MODULE ${SOURCE} wdmaud.rc)
 set_module_type(wdmaud kernelmodedriver)
-target_link_libraries(wdmaud mmixer libcntpr)
+target_link_libraries(wdmaud mmixer libcntpr pseh)
 add_pch(wdmaud wdmaud.h SOURCE)
 add_importlibs(wdmaud ntoskrnl ks hal)
 add_cd_file(TARGET wdmaud DESTINATION reactos/system32/drivers FOR all)
diff --git a/drivers/wdm/audio/legacy/wdmaud/control.c b/drivers/wdm/audio/legacy/wdmaud/control.c
index 5aecad326d0..857cd7d935d 100644
--- a/drivers/wdm/audio/legacy/wdmaud/control.c
+++ b/drivers/wdm/audio/legacy/wdmaud/control.c
@@ -253,12 +253,22 @@ WdmAudGetDeviceInterface(
     {
         /* buffer too small */
         DeviceInfo->u.Interface.DeviceInterfaceStringSize = Length;
+        FreeItem(Device);
         return SetIrpIoStatus(Irp, STATUS_BUFFER_OVERFLOW, sizeof(WDMAUD_DEVICE_INFO));
     }
     else
     {
-        //FIXME SEH
-        RtlMoveMemory(DeviceInfo->u.Interface.DeviceInterfaceString, Device, Length);
+        _SEH2_TRY
+        {
+            ProbeForWrite(DeviceInfo->u.Interface.DeviceInterfaceString, Length, sizeof(WCHAR));
+            RtlMoveMemory(DeviceInfo->u.Interface.DeviceInterfaceString, Device, Length);
+        }
+        _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
+        {
+            FreeItem(Device);
+            return SetIrpIoStatus(Irp, _SEH2_GetExceptionCode(), 0);
+        }
+        _SEH2_END;
     }
 
     FreeItem(Device);
diff --git a/drivers/wdm/audio/legacy/wdmaud/wdmaud.h b/drivers/wdm/audio/legacy/wdmaud/wdmaud.h
index 12588f0a2a5..c49e7559071 100644
--- a/drivers/wdm/audio/legacy/wdmaud/wdmaud.h
+++ b/drivers/wdm/audio/legacy/wdmaud/wdmaud.h
@@ -3,6 +3,7 @@
 
 #include <portcls.h>
 #include <mmsystem.h>
+#include <pseh/pseh2.h>
 
 #include "interface.h"