Skip to content

Commit 2d014b6

Browse files
committed
Kernel: Fix IoCreateFile double-deref, IoDeleteSymbolicLink handle leak, IoSynchronous* stubs
- IoCreateFile: null OpenPacket.FileObject after dereferencing it in the error path to prevent the final cleanup from dereferencing it again (double-free/use-after-free on file open failures) - IoDeleteSymbolicLink: always close the Handle regardless of whether NtMakeTemporaryObject succeeds (handle leak on every failed symlink deletion, accumulating during dashboard transitions) - IoSynchronousDeviceIoControlRequest and IoSynchronousFsdRequest: return X_STATUS_NOT_IMPLEMENTED instead of S_OK so games hit their error paths rather than reading uninitialized output buffers
1 parent c9aec91 commit 2d014b6

1 file changed

Lines changed: 4 additions & 5 deletions

File tree

src/core/kernel/exports/EmuKrnlIo.cpp

Lines changed: 4 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -574,6 +574,7 @@ XBSYSAPI EXPORTNUM(66) xbox::ntstatus_xt NTAPI xbox::IoCreateFile
574574
/* Clear the device object to invalidate the FO, and dereference */
575575
OpenPacket.FileObject->DeviceObject = nullptr;
576576
ObfDereferenceObject(OpenPacket.FileObject);
577+
OpenPacket.FileObject = nullptr;
577578
}
578579
}
579580
else {
@@ -681,9 +682,7 @@ XBSYSAPI EXPORTNUM(69) xbox::ntstatus_xt NTAPI xbox::IoDeleteSymbolicLink
681682

682683
/* Make the link temporary and close its handle */
683684
result = NtMakeTemporaryObject(Handle);
684-
if (X_NT_SUCCESS(result)) {
685-
NtClose(Handle);
686-
}
685+
NtClose(Handle);
687686

688687
RETURN(result);
689688
}
@@ -1565,7 +1564,7 @@ XBSYSAPI EXPORTNUM(84) xbox::ntstatus_xt NTAPI xbox::IoSynchronousDeviceIoContro
15651564

15661565
LOG_UNIMPLEMENTED();
15671566

1568-
RETURN(S_OK);
1567+
RETURN(X_STATUS_NOT_IMPLEMENTED);
15691568
}
15701569

15711570
// ******************************************************************
@@ -1590,7 +1589,7 @@ XBSYSAPI EXPORTNUM(85) xbox::ntstatus_xt NTAPI xbox::IoSynchronousFsdRequest
15901589

15911590
LOG_UNIMPLEMENTED();
15921591

1593-
RETURN(S_OK);
1592+
RETURN(X_STATUS_NOT_IMPLEMENTED);
15941593
}
15951594

15961595
// ******************************************************************

0 commit comments

Comments
 (0)