Skip to content

[UDFS] Fix double free BSOD in UDFDirIndexFree detected by Driver Verifier #339

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
Copilot wants to merge 8 commits into
base: udf-dev
Choose a base branch
from
Draft

[UDFS] Fix double free BSOD in UDFDirIndexFree detected by Driver Verifier #339

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
cffe655
refactoring
assorted Feb 2, 2026
a3305a9
UDFInsertPrefix
assorted Feb 14, 2026
991f517
Merge branch 'udf-dev' of https://github.com/zero3k20/reactos into ud…
Zero3K20 Apr 27, 2026
e1b73a1
Initial plan
Copilot Apr 30, 2026
e990860
[UDFS] Fix double free BSOD in UDFDirIndexFree detected by Driver Ver…
Copilot Apr 30, 2026
e9e5b3d
[UDFS] Fix 0xC4/0x13a BSOD in UDFDeleteCcb: add NULL check on Directo…
Copilot Apr 30, 2026
db0389a
udfs: drain FCB resources before ExDeleteResourceLite to fix BSOD 0xC…
Copilot May 1, 2026
4f99d57
udfs: add CcbListResource ERESOURCE to FCB_NONPAGED and delete before…
Copilot May 1, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 6 additions & 1 deletion drivers/filesystems/udfs/dircntrl.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -279,7 +279,10 @@ UDFQueryDirectory(
// check whether we need to store this search pattern in
// the CCB.
if (Ccb->DirectorySearchPattern) {
MyFreePool__(Ccb->DirectorySearchPattern->Buffer);
if (Ccb->DirectorySearchPattern->Buffer) {
MyFreePool__(Ccb->DirectorySearchPattern->Buffer);
Ccb->DirectorySearchPattern->Buffer = NULL;
}
MyFreePool__(Ccb->DirectorySearchPattern);
Ccb->DirectorySearchPattern = NULL;
}
Expand All @@ -297,6 +300,8 @@ UDFQueryDirectory(
Ccb->DirectorySearchPattern->MaximumLength = PtrSearchPattern->MaximumLength;
Ccb->DirectorySearchPattern->Buffer = (PWCHAR)MyAllocatePool__(NonPagedPool,PtrSearchPattern->MaximumLength);
if (!(Ccb->DirectorySearchPattern->Buffer)) {
MyFreePool__(Ccb->DirectorySearchPattern);
Ccb->DirectorySearchPattern = NULL;
try_return(RC = STATUS_INSUFFICIENT_RESOURCES);
}
RtlCopyMemory(Ccb->DirectorySearchPattern->Buffer,PtrSearchPattern->Buffer,
Expand Down
15 changes: 13 additions & 2 deletions drivers/filesystems/udfs/strucsup.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -144,6 +144,7 @@ Return Value:

ExInitializeResourceLite(&FcbNonpaged->FcbPagingIoResource);
ExInitializeResourceLite(&FcbNonpaged->FcbResource);
ExInitializeResourceLite(&FcbNonpaged->CcbListResource);
ExInitializeFastMutex(&FcbNonpaged->FcbMutex);
ExInitializeFastMutex(&FcbNonpaged->AdvancedFcbHeaderMutex);
ExInitializeFastMutex(&FcbNonpaged->FcbFastMutex);
Expand Down Expand Up @@ -175,11 +176,21 @@ Return Value:

{
PAGED_CODE();

UNREFERENCED_PARAMETER(IrpContext);


// Acquire each resource exclusively to drain any active holders before
// calling ExDeleteResourceLite. Freeing a pool block that still contains
// an active ERESOURCE triggers Driver Verifier bugcheck 0xC4/0xD2.
ExAcquireResourceExclusiveLite(&FcbNonpaged->FcbPagingIoResource, TRUE);
ExReleaseResourceLite(&FcbNonpaged->FcbPagingIoResource);

ExAcquireResourceExclusiveLite(&FcbNonpaged->FcbResource, TRUE);
ExReleaseResourceLite(&FcbNonpaged->FcbResource);

ExDeleteResourceLite(&FcbNonpaged->FcbResource);
ExDeleteResourceLite(&FcbNonpaged->FcbPagingIoResource);
ExDeleteResourceLite(&FcbNonpaged->CcbListResource);

UDFDeallocateFcbNonpaged(FcbNonpaged);

Expand Down
4 changes: 4 additions & 0 deletions drivers/filesystems/udfs/struct.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -151,6 +151,10 @@ struct FCB_NONPAGED {

ERESOURCE FcbPagingIoResource;

// Resource protecting the CCB list on this Fcb.

ERESOURCE CcbListResource;

// This is the FastMutex for this Fcb.

FAST_MUTEX FcbMutex;
Expand Down
2 changes: 1 addition & 1 deletion drivers/filesystems/udfs/udf_info/dirtree.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -102,8 +102,8 @@ UDFDirIndexFree(
uint32 k;
PDIR_INDEX_ITEM* FrameList;

FrameList = (PDIR_INDEX_ITEM*)(hDirNdx+1);
if (!hDirNdx) return;
FrameList = (PDIR_INDEX_ITEM*)(hDirNdx+1);
for(k=0; k<hDirNdx->FrameCount; k++, FrameList++) {
if (*FrameList) MyFreePool__(*FrameList);
}
Expand Down
23 changes: 15 additions & 8 deletions drivers/filesystems/udfs/udf_info/udf_info.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2604,24 +2604,31 @@ UDFCleanUpFile__(
}
#endif //UDF_TRACK_ONDISK_ALLOCATION
if (FileInfo->Dloc->DirIndex) {
PDIR_INDEX_HDR tmpDirIndex;
uint_di i;
for(i=2; (DirNdx = UDFDirIndex(Dloc->DirIndex,i)); i++) {
tmpDirIndex = Dloc->DirIndex;
Dloc->DirIndex = NULL;
for(i=2; (DirNdx = UDFDirIndex(tmpDirIndex,i)); i++) {
ASSERT(!DirNdx->FileInfo);
if (DirNdx->FName.Buffer)
if (DirNdx->FName.Buffer) {
MyFreePool__(DirNdx->FName.Buffer);
DirNdx->FName.Buffer = NULL;
}
}
UDFDirIndexFree(Dloc->DirIndex);
Dloc->DirIndex = NULL;
UDFDirIndexFree(tmpDirIndex);
#ifdef UDF_TRACK_ONDISK_ALLOCATION
UDFIndexDirectory(Vcb, FileInfo);
if (FileInfo->Dloc->DirIndex) {
for(i=2; DirNdx = UDFDirIndex(Dloc->DirIndex,i); i++) {
tmpDirIndex = Dloc->DirIndex;
Dloc->DirIndex = NULL;
for(i=2; (DirNdx = UDFDirIndex(tmpDirIndex,i)); i++) {
ASSERT(!DirNdx->FileInfo);
if (DirNdx->FName.Buffer)
if (DirNdx->FName.Buffer) {
MyFreePool__(DirNdx->FName.Buffer);
DirNdx->FName.Buffer = NULL;
}
}
UDFDirIndexFree(Dloc->DirIndex);
Dloc->DirIndex = NULL;
UDFDirIndexFree(tmpDirIndex);
}
#endif //UDF_TRACK_ONDISK_ALLOCATION
}
Expand Down