Merge pull request #35 from mrexodia/fix_leaks

fixed some handle/memory leaks and a possible NULL dereference
NtQuery · Feb 27, 2016 · 0ca2c1a · 0ca2c1a
2 parents 93d2a2c + fca8288
commit 0ca2c1a
Show file tree

Hide file tree

Showing 4 changed files with 12 additions and 3 deletions.
diff --git a/Scylla/FunctionExport.cpp b/Scylla/FunctionExport.cpp
@@ -40,12 +40,14 @@ BOOL DumpProcessW(const WCHAR * fileToDump, DWORD_PTR imagebase, DWORD_PTR entry
 		peFile = new PeParser(imagebase, true);
 	}
 
-	return peFile->dumpProcess(imagebase, entrypoint, fileResult);
+	bool result = peFile->dumpProcess(imagebase, entrypoint, fileResult);
+
+	delete peFile;
+	return result;
 }
 
 BOOL WINAPI ScyllaRebuildFileW(const WCHAR * fileToRebuild, BOOL removeDosStub, BOOL updatePeHeaderChecksum, BOOL createBackup)
 {
-
 	if (createBackup)
 	{
 		if (!ProcessAccessHelp::createBackupFile(fileToRebuild))
@@ -291,6 +293,5 @@ int WINAPI ScyllaIatFixAutoW(DWORD_PTR iatAddr, DWORD iatSize, DWORD dwProcessId
 	ProcessAccessHelp::closeProcessHandle();
 	apiReader.clearAll();
 
-
 	return retVal;
 }
diff --git a/Scylla/IATSearch.cpp b/Scylla/IATSearch.cpp
@@ -51,6 +51,7 @@ bool IATSearch::findIATAdvanced( DWORD_PTR startAddress, DWORD_PTR* addressIAT,
 #ifdef DEBUG_COMMENTS
 		Scylla::debugLog.log(L"findAPIAddressInIAT2 :: error reading memory");
 #endif
+		delete [] dataBuffer;
 		return false;
 	}
 
@@ -279,6 +280,7 @@ bool IATSearch::findIATStartAndSize(DWORD_PTR address, DWORD_PTR * addressIAT, D
 #ifdef DEBUG_COMMENTS
 		Scylla::debugLog.log(L"findIATStartAddress :: error reading memory");
 #endif
+		delete [] dataBuffer;
 		return false;
 	}
 

diff --git a/Scylla/ProcessAccessHelp.cpp b/Scylla/ProcessAccessHelp.cpp
@@ -601,6 +601,7 @@ LPVOID ProcessAccessHelp::createFileMappingView(const WCHAR * filePath, DWORD ac
 #ifdef DEBUG_COMMENTS
 		Scylla::debugLog.log(L"createFileMappingView :: GetLastError() == ERROR_ALREADY_EXISTS");
 #endif
+		CloseHandle(hMappedFile);
 		return NULL;
 	}
 

diff --git a/Scylla/TreeImportExport.cpp b/Scylla/TreeImportExport.cpp
@@ -40,6 +40,11 @@ bool TreeImportExport::importTreeList(std::map<DWORD_PTR, ImportModuleThunk> & m
 	}
 
 	TiXmlElement * targetElement = doc.FirstChildElement();
+	if (!targetElement)
+	{
+		Sylla::windowLog.log(L"Load Tree :: Error getting first child element in xml %S\r\n", doc.Value());
+		return false;
+	}
 
 	*addressOEP = ConvertStringToDwordPtr(targetElement->Attribute("oep_va"));
 	*addressIAT = ConvertStringToDwordPtr(targetElement->Attribute("iat_va"));