大致代码如下:
一个链表结构,
- typedef struct _P
- {
- ULONG Addr;
- int ID;
- UCHAR N[16];
- struct _P *link;
- }P, *PP;
驱动中全局变量：
- PP head = NULL;
- PP pi = NULL;
在DispatchIoctl函数中，处理IOCTL时，
- case IOCTL_TEST:
- {
- PP q;
- ...
- if(head == NULL)
- {
- head = (PP)ExAllocatePool(NonPagedPool,sizeof(PP));
- if(head == NULL)
- status = STATUS_INSUFFICIENT_RESOURCES;
- head->Addr = 0x0;
- }
- if(head->Addr == 0x0)
- {
- head->Addr = 1;
- pi = head;
- }
- status = A();
- if(!NT_SUCCESS(status))
- break;
- if(head == NULL)
- {
- status = STATUS_SUCCESS;
- break;
- }
- for(pi = head; pi; pi = pi->link)
- {
- ... //填充P结构的其他域
- ... //拷贝结果到buffer中
- }
- //free the link list
- pi = head;
- q = pi->link;
- while(q != NULL)
- {
- ExFreePool(pi); ------------------> 使用Windbg单步到此处，继续执行变产生蓝屏，BAD_POOL_HEADER, Parameter 1为0x20
- pi = q;
- q = pi->link;
- }
- ExFreePool(pi);
-
- status = STATUS_SUCCESS;
- break;
- }
其中函数A大概如下，
- NTSTATUS A()
- {
- ...
- status = RecordInfo(object);
- ...
- }
函数RecordInfo如下:
- NTSTATUS RecordInfo(ULONG ob)
- {
- PP r;
- NTSTATUS status;
- r = (PP)ExAllocatePool(NonPagedPool,sizeof(PP));
- if(r == NULL)
- status = STATUS_INSUFFICIENT_RESOURCES;
- pi->link = r;
- r->Addr = ob;
- r->link = NULL;
- pi = r;
- status = STATUS_SUCCESS;
- return status;
- }
请问该怎么解决这个问题？
京公网安备 11010802033920号
