Memory leakage in message

"sizeof(SCANNER_MESSAGE) * threadCount * requestCount" bytes long memory is allocated but only "sizeof(SCANNER_MESSAGE) * threadCount" bytes long of it is freed.

1 files changed, 8 insertions, 15 deletions

diff --git a/filesys/miniFilter/scanner/user/scanUser.c b/filesys/miniFilter/scanner/user/scanUser.c
index e766261c..3160d5b4 100644
--- a/filesys/miniFilter/scanner/user/scanUser.c
+++ b/filesys/miniFilter/scanner/user/scanUser.c
@@ -151,7 +151,6 @@ Return Value
 {
     PSCANNER_NOTIFICATION notification;
     SCANNER_REPLY_MESSAGE replyMessage;
-    PSCANNER_MESSAGE message;
     LPOVERLAPPED pOvlp;
     BOOL result;
     DWORD outSize;
@@ -254,8 +253,6 @@ Return Value
         }
     }
 
-    free( message );
-
     return hr;
 }
 
@@ -271,7 +268,7 @@ main (
     HANDLE threads[SCANNER_MAX_THREAD_COUNT];
     SCANNER_THREAD_CONTEXT context;
     HANDLE port, completion;
-    PSCANNER_MESSAGE msg;
+    PSCANNER_MESSAGE messages;
     DWORD threadId;
     HRESULT hr;
     DWORD i, j;
@@ -342,12 +339,14 @@ main (
     context.Port = port;
     context.Completion = completion;
 
+    messages = malloc(sizeof(SCANNER_MESSAGE) * threadCount * requestCount);
+
     //
     //  Create specified number of threads.
     //
 
     for (i = 0; i < threadCount; i++) {
-
+        
         threads[i] = CreateThread( NULL,
                                    0,
                                    (LPTHREAD_START_ROUTINE) ScannerWorker,
@@ -372,14 +371,8 @@ main (
             //  Allocate the message.
             //
 
-#pragma prefast(suppress:__WARNING_MEMORY_LEAK, "msg will not be leaked because it is freed in ScannerWorker")
-            msg = malloc( sizeof( SCANNER_MESSAGE ) );
 
-            if (msg == NULL) {
-
-                hr = ERROR_NOT_ENOUGH_MEMORY;
-                goto main_cleanup;
-            }
+            PSCANNER_MESSAGE msg = &(messages[i * j]);
 
             memset( &msg->Ovlp, 0, sizeof( OVERLAPPED ) );
 
@@ -393,8 +386,6 @@ main (
                                    &msg->Ovlp );
 
             if (hr != HRESULT_FROM_WIN32( ERROR_IO_PENDING )) {
-
-                free( msg );
                 goto main_cleanup;
             }
         }
@@ -403,7 +394,7 @@ main (
     hr = S_OK;
 
     WaitForMultipleObjectsEx( i, threads, TRUE, INFINITE, FALSE );
-
+    
 main_cleanup:
 
     printf( "Scanner:  All done. Result = 0x%08x\n", hr );
@@ -411,6 +402,8 @@ main_cleanup:
     CloseHandle( port );
     CloseHandle( completion );
 
+    free(messages);
+
     return hr;
 }