Potential access NULL pointer in mhook.c about mhook HOT 8 CLOSED

Hi @pvthuyet ,

You're right. However this situation will never happen as a current process id is always present in a processes snapshot. Also the solution requires CloseProcessSnapshot.

I think it's better to add a comment there instead of writing a code to handle the impossible situation.

BTW, did you find this manually or with some automatic tool?

from mhook.

Hi @SergiusTheBest ,

BTW, did you find this manually or with some automatic tool?

I met this problem with my project. Some how can't get the process info from snapshot, then access the NULL pointer.

Also the solution requires CloseProcessSnapshot

I got your point.

from mhook.

Are you able to reproduce this issue?

from mhook.

Hi @SergiusTheBest ,
Now i know the root cause.
I hooked ZwQuerySystemInformation and modified the result.
That why can't find the process from snapshot.
Therefore, we should check the NULL pointer too.

from mhook.

Oh, so that's you messed up with WinAPI. Without the check you'll know that something is wrong much faster!

from mhook.

thank you @SergiusTheBest

from mhook.

@SergiusTheBest ,
But how about this fix to void crash if someone messed up as mine

...
	if (NULL == *procInfo) {
		CloseProcessSnapshot(*snapshot);
		return FALSE;
	}

	return TRUE;

from mhook.

A crash is a better indication that something is really wrong.

from mhook.