TunDispatchSecurityDescriptor will leak if second RtlAbsoluteToSelfRelativeSD fails. Practically this can't happen, but from wintun code it's unclear.
Signed-off-by: Shawn Hoffman <godisgovernm...@gmail.com> --- wintun.c | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-) diff --git a/wintun.c b/wintun.c index 624de2f..90e7930 100644 --- a/wintun.c +++ b/wintun.c @@ -820,6 +820,14 @@ static NTSTATUS TunInitializeDispatchSecurityDescriptor(VOID) return STATUS_SUCCESS; } +static VOID TunFreeDispatchSecurityDescriptor(VOID) +{ + if (!TunDispatchSecurityDescriptor) + return; + ExFreePoolWithTag(TunDispatchSecurityDescriptor, TUN_MEMORY_TAG); + TunDispatchSecurityDescriptor = NULL; +} + _IRQL_requires_max_(PASSIVE_LEVEL) static VOID TunProcessNotification(HANDLE ParentId, HANDLE ProcessId, BOOLEAN Create) @@ -1387,7 +1395,7 @@ TunUnload(PDRIVER_OBJECT DriverObject) NdisMDeregisterMiniportDriver(NdisMiniportDriverHandle); ExDeleteResourceLite(&TunDispatchCtxGuard); ExDeleteResourceLite(&TunDispatchDeviceListLock); - ExFreePoolWithTag(TunDispatchSecurityDescriptor, TUN_MEMORY_TAG); + TunFreeDispatchSecurityDescriptor(); } DRIVER_INITIALIZE DriverEntry; @@ -1398,7 +1406,7 @@ DriverEntry(DRIVER_OBJECT *DriverObject, UNICODE_STRING *RegistryPath) NTSTATUS Status; if (!NT_SUCCESS(Status = TunInitializeDispatchSecurityDescriptor())) - return Status; + goto cleanupSD; NdisVersion = NdisGetVersion(); if (NdisVersion < NDIS_MINIPORT_VERSION_MIN) @@ -1461,6 +1469,7 @@ cleanupNotifier: cleanupResources: ExDeleteResourceLite(&TunDispatchCtxGuard); ExDeleteResourceLite(&TunDispatchDeviceListLock); - ExFreePoolWithTag(TunDispatchSecurityDescriptor, TUN_MEMORY_TAG); +cleanupSD: + TunFreeDispatchSecurityDescriptor(); return Status; } -- 2.26.2.windows.1