From e1b5f060066958cf1f5b185acac9bd9eabf93862 Mon Sep 17 00:00:00 2001
From: asava <asava@users.noreply.github.com>
Date: Sun, 10 May 2020 14:06:04 +0300
Subject: [PATCH] Avoid hang due to double free: FileInfo is also freed by
 DirIter* methods

---
 rEFIt_UEFI/entry_scan/loader.cpp | 25 -------------------------
 1 file changed, 25 deletions(-)

diff --git a/rEFIt_UEFI/entry_scan/loader.cpp b/rEFIt_UEFI/entry_scan/loader.cpp
index ad25a881a..6061eebaf 100644
--- a/rEFIt_UEFI/entry_scan/loader.cpp
+++ b/rEFIt_UEFI/entry_scan/loader.cpp
@@ -1190,15 +1190,11 @@ STATIC VOID LinuxScan(REFIT_VOLUME *Volume, UINT8 KernelScan, UINT8 Type, XStrin
           while (DirIterNext(&Iter, 2, LINUX_LOADER_SEARCH_PATH, &FileInfo)) {
             if (FileInfo != NULL) {
               if (FileInfo->FileSize == 0) {
-                FreePool(FileInfo);
-                FileInfo = NULL;
                 continue;
               }
               // get the kernel file path
               Path.SWPrintf("%ls\\%ls", LINUX_BOOT_PATH, FileInfo->FileName);
               // free the file info
-              FreePool(FileInfo);
-              FileInfo = NULL;
               break;
             }
           }
@@ -1211,9 +1207,6 @@ STATIC VOID LinuxScan(REFIT_VOLUME *Volume, UINT8 KernelScan, UINT8 Type, XStrin
                 // get the kernel file path
                 Path.SWPrintf("%ls\\%ls", LINUX_BOOT_PATH, FileInfo->FileName);
               }
-              // free the file info
-              FreePool(FileInfo);
-              FileInfo = NULL;
             }
           }
           break;
@@ -1228,9 +1221,6 @@ STATIC VOID LinuxScan(REFIT_VOLUME *Volume, UINT8 KernelScan, UINT8 Type, XStrin
                   PreviousTime = FileInfo->ModificationTime;
                 }
               }
-              // free the file info
-              FreePool(FileInfo);
-              FileInfo = NULL;
             }
           }
           break;
@@ -1245,9 +1235,6 @@ STATIC VOID LinuxScan(REFIT_VOLUME *Volume, UINT8 KernelScan, UINT8 Type, XStrin
                   PreviousTime = FileInfo->ModificationTime;
                 }
               }
-              // free the file info
-              FreePool(FileInfo);
-              FileInfo = NULL;
             }
           }
           break;
@@ -1264,9 +1251,6 @@ STATIC VOID LinuxScan(REFIT_VOLUME *Volume, UINT8 KernelScan, UINT8 Type, XStrin
                     Path.setEmpty();
                 }
               }
-              // free the file info
-              FreePool(FileInfo);
-              FileInfo = NULL;
             }
           }
           break;
@@ -1283,9 +1267,6 @@ STATIC VOID LinuxScan(REFIT_VOLUME *Volume, UINT8 KernelScan, UINT8 Type, XStrin
                   Path.setEmpty();
                 }
               }
-              // free the file info
-              FreePool(FileInfo);
-              FileInfo = NULL;
             }
           }
           break;
@@ -1322,9 +1303,6 @@ STATIC VOID LinuxScan(REFIT_VOLUME *Volume, UINT8 KernelScan, UINT8 Type, XStrin
               AddLoaderEntry(Path, (Options.isEmpty()) ? LINUX_DEFAULT_OPTIONS : Options, L""_XSW, Volume, NULL, OSTYPE_LINEFI, OSFLAG_NODEFAULTARGS);
               Path.setEmpty();
             }
-             // free the file info
-            FreePool(FileInfo);
-            FileInfo = NULL;
           }
         }
       }
@@ -1761,13 +1739,10 @@ STATIC VOID AddCustomEntry(IN UINTN                CustomIndex,
         }
         // who knows....
         if (FileInfo->FileSize == 0) {
-          FreePool(FileInfo);
           continue;
         }
         // get the kernel file path
         CustomPath.SWPrintf("%ls\\%ls", LINUX_BOOT_PATH, FileInfo->FileName);
-        // free the file info
-        FreePool(FileInfo);
       }
       if (CustomPath.isEmpty()) {
         DBG("skipped\n");