Illegal PhFree() in pfn.c

[gvanem]

There is a crash in MemoryExtPlugin.dll due to a potential illegal pointer given to PhFree(). I.e. when status == STATUS_BUFFER_TOO_SMALL for whatever reason , thus:

MemoryRanges = &rangeInfo;

I've fixed this like so:

--- a/MemoryExtPlugin/pfn.c 2018-03-26 21:59:43
+++ b/MemoryExtPlugin/pfn.c 2018-03-26 21:51:18
@@ -263,6 +263,7 @@
 ULONG MmPfnDatabaseSize;
 HANDLE PfiFileInfoHandle = NULL;
 PPF_MEMORY_RANGE_INFO MemoryRanges = NULL;
+BOOLEAN MemoryRanges_is_local = FALSE;
 PVOID BitMapBuffer = NULL;
 PPH_LIST ProcessKeyList;
 PPH_LIST FileKeyList;
@@ -323,6 +324,7 @@
     {
         // Use local buffer
         MemoryRanges = &rangeInfo;
+        MemoryRanges_is_local = TRUE;
     }

     return status;
@@ -1185,7 +1187,7 @@
                 PhFree(BitMapBuffer);
             if (MmPfnDatabase)
                 PhFree(MmPfnDatabase);
-            if (MemoryRanges)
+            if (MemoryRanges && !MemoryRanges_is_local)
                 PhFree(MemoryRanges);
             PhReleaseQueuedLockExclusive(&context->LogMessageListLock);

Many thanks for a super program!

Edit: The status == STATUS_BUFFER_TOO_SMALL was in a x86-build. In a x64-build, all seems okay. I'm on Win-10 (x64).

[dmex]

Thanks!