Akihiro Sagawa : ntdll: Fix use-after-free.

[Alexandre Julliard]

Module: wine
Branch: master
Commit: 8a3e0d686ea4cbff33dc45bb63e71f132c22797a
URL:    https://source.winehq.org/git/wine.git/?a=commit;h=8a3e0d686ea4cbff33dc45bb6...

Author: Akihiro Sagawa 
Date:   Sun Aug 29 21:35:14 2021 +0900

ntdll: Fix use-after-free.

Fixes a regression introduced by 76f949577aac88bbde4e9e7b904587f5bc8c808d.
nt_name or redir is used in open_unix_file() because attr.ObjectName
points to either of them.

Wine-Bug: https://bugs.winehq.org/show_bug.cgi?id=51702
Signed-off-by: Akihiro Sagawa 
Signed-off-by: Alexandre Julliard

---

dlls/ntdll/unix/process.c | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/dlls/ntdll/unix/process.c b/dlls/ntdll/unix/process.c
index d7f3edf4330..f5b8b5315cd 100644
--- a/dlls/ntdll/unix/process.c
+++ b/dlls/ntdll/unix/process.c
@@ -368,16 +368,18 @@ static int get_unix_curdir( const RTL_USER_PROCESS_PARAMETERS *params )
     InitializeObjectAttributes( &attr, &nt_name, OBJ_CASE_INSENSITIVE, 0, NULL );
     get_redirect( &attr, &redir );
     status = nt_to_unix_file_name( &attr, &unix_name, FILE_OPEN );
-    free( nt_name.Buffer );
-    free( redir.Buffer );
-    if (status) return -1;
+    if (status) goto done;
     status = open_unix_file( &handle, unix_name, FILE_TRAVERSE | SYNCHRONIZE, &attr, 0,
                              FILE_SHARE_READ | FILE_SHARE_DELETE,
                              FILE_OPEN, FILE_SYNCHRONOUS_IO_NONALERT, NULL, 0 );
     free( unix_name );
-    if (status) return -1;
+    if (status) goto done;
     wine_server_handle_to_fd( handle, FILE_TRAVERSE, &fd, NULL );
     NtClose( handle );
+
+done:
+    free( nt_name.Buffer );
+    free( redir.Buffer );
     return fd;
 }