From 09d14a24624ebd87fef421d75cec55382856d445 Mon Sep 17 00:00:00 2001 From: Armin Novak Date: Mon, 28 Oct 2019 14:28:11 +0100 Subject: [PATCH] Fixed VirtualChannelWriteEx error case leaks. --- channels/encomsp/client/encomsp_main.c | 9 +++++++-- channels/rail/client/rail_main.c | 3 +++ channels/rdp2tcp/client/rdp2tcp_main.c | 12 +++++++++--- channels/rdpdr/client/rdpdr_main.c | 6 ++++++ channels/remdesk/client/remdesk_main.c | 17 ++++------------- 5 files changed, 29 insertions(+), 18 deletions(-) diff --git a/channels/encomsp/client/encomsp_main.c b/channels/encomsp/client/encomsp_main.c index d595fefc2..5e2d8d7cb 100644 --- a/channels/encomsp/client/encomsp_main.c +++ b/channels/encomsp/client/encomsp_main.c @@ -112,7 +112,10 @@ static UINT encomsp_virtual_channel_write(encomspPlugin* encomsp, wStream* s) UINT status; if (!encomsp) + { + Stream_Free(s, TRUE); return ERROR_INVALID_HANDLE; + } #if 0 WLog_INFO(TAG, "EncomspWrite (%"PRIuz")", Stream_Length(s)); @@ -123,9 +126,11 @@ static UINT encomsp_virtual_channel_write(encomspPlugin* encomsp, wStream* s) Stream_Buffer(s), (UINT32) Stream_Length(s), s); if (status != CHANNEL_RC_OK) + { + Stream_Free(s, TRUE); WLog_ERR(TAG, "VirtualChannelWriteEx failed with %s [%08"PRIX32"]", - WTSErrorToString(status), status); - + WTSErrorToString(status), status); + } return status; } diff --git a/channels/rail/client/rail_main.c b/channels/rail/client/rail_main.c index a69e7f82a..12491c07a 100644 --- a/channels/rail/client/rail_main.c +++ b/channels/rail/client/rail_main.c @@ -56,7 +56,10 @@ static UINT rail_send(railPlugin* rail, wStream* s) UINT status; if (!rail) + { + Stream_Free(s, TRUE); return CHANNEL_RC_BAD_INIT_HANDLE; + } status = rail->channelEntryPoints.pVirtualChannelWriteEx(rail->InitHandle, rail->OpenHandle, Stream_Buffer(s), (UINT32) Stream_GetPosition(s), s); diff --git a/channels/rdp2tcp/client/rdp2tcp_main.c b/channels/rdp2tcp/client/rdp2tcp_main.c index 930d938eb..b36a380fe 100644 --- a/channels/rdp2tcp/client/rdp2tcp_main.c +++ b/channels/rdp2tcp/client/rdp2tcp_main.c @@ -143,12 +143,15 @@ static DWORD WINAPI copyThread(void* data) if (!buffer) { fprintf(stderr, "rdp2tcp copyThread: malloc failed\n"); - return -1; + goto fail; } //if (!ReadFile(plugin->hStdOutputRead, plugin->buffer, sizeof plugin->buffer, &dwRead, NULL)) if (!ReadFile(plugin->hStdOutputRead, buffer, bufsize, &dwRead, NULL)) - return -1; + { + free(buffer); + goto fail; + } if (debug > 1) { @@ -159,14 +162,17 @@ static DWORD WINAPI copyThread(void* data) if (plugin->channelEntryPoints.pVirtualChannelWriteEx(plugin->initHandle, plugin->openHandle, buffer, dwRead, NULL) != CHANNEL_RC_OK) { + free(buffer); fprintf(stderr, "rdp2tcp copyThread failed %i\n", (int)dwRead); - return -1; + goto fail; } WaitForSingleObject(plugin->writeComplete, INFINITE); ResetEvent(plugin->writeComplete); } +fail: + ExitThread(0); return 0; } diff --git a/channels/rdpdr/client/rdpdr_main.c b/channels/rdpdr/client/rdpdr_main.c index 0e7b4a011..d018e99de 100644 --- a/channels/rdpdr/client/rdpdr_main.c +++ b/channels/rdpdr/client/rdpdr_main.c @@ -1471,10 +1471,16 @@ UINT rdpdr_send(rdpdrPlugin* rdpdr, wStream* s) rdpdrPlugin* plugin = (rdpdrPlugin*) rdpdr; if (!rdpdr || !s) + { + Stream_Free(s, TRUE); return CHANNEL_RC_NULL_DATA; + } if (!plugin) + { + Stream_Free(s, TRUE); status = CHANNEL_RC_BAD_INIT_HANDLE; + } else { status = plugin->channelEntryPoints.pVirtualChannelWriteEx(plugin->InitHandle, plugin->OpenHandle, diff --git a/channels/remdesk/client/remdesk_main.c b/channels/remdesk/client/remdesk_main.c index 2ded4789d..1fe668673 100644 --- a/channels/remdesk/client/remdesk_main.c +++ b/channels/remdesk/client/remdesk_main.c @@ -45,6 +45,7 @@ static UINT remdesk_virtual_channel_write(remdeskPlugin* remdesk, wStream* s) if (!remdesk) { WLog_ERR(TAG, "remdesk was null!"); + Stream_Free(s, TRUE); return CHANNEL_RC_INVALID_INSTANCE; } @@ -53,9 +54,11 @@ static UINT remdesk_virtual_channel_write(remdeskPlugin* remdesk, wStream* s) Stream_Buffer(s), (UINT32) Stream_Length(s), s); if (status != CHANNEL_RC_OK) + { + Stream_Free(s, TRUE); WLog_ERR(TAG, "pVirtualChannelWriteEx failed with %s [%08"PRIX32"]", WTSErrorToString(status), status); - + } return status; } @@ -294,9 +297,6 @@ static UINT remdesk_send_ctl_version_info_pdu(remdeskPlugin* remdesk) if ((error = remdesk_virtual_channel_write(remdesk, s))) WLog_ERR(TAG, "remdesk_virtual_channel_write failed with error %"PRIu32"!", error); - if (error != CHANNEL_RC_OK) - Stream_Free(s, TRUE); - return error; } @@ -389,9 +389,6 @@ out: free(raConnectionStringW); free(expertBlobW); - if (error != CHANNEL_RC_OK) - Stream_Free(s, TRUE); - return error; } @@ -440,9 +437,6 @@ static UINT remdesk_send_ctl_remote_control_desktop_pdu(remdeskPlugin* remdesk) out: free(raConnectionStringW); - if (error != CHANNEL_RC_OK) - Stream_Free(s, TRUE); - return error; } @@ -497,9 +491,6 @@ static UINT remdesk_send_ctl_verify_password_pdu(remdeskPlugin* remdesk) out: free(expertBlobW); - if (error != CHANNEL_RC_OK) - Stream_Free(s, TRUE); - return error; }