tiny correctness bug in snapshot_process()

[fortra]

tiny correctness bug in snapshot_process()

[S4ntiagoP]

Hey man!
I greatly appreciate you looking into the code closely enough as to find stuff like that. I care a lot about this kind of bugs, which can be elusive and hard to find.

That being said, are you sure this is really a bug?
Look at the cleanup section:

cleanup:
    if (hProcess)
        NtClose(hProcess);
    if (!ret_val && *hSnapshot)
        NtClose(*hSnapshot);
    if (!ret_val && hCloneProcess)
        NtClose(hCloneProcess);

    if (ret_val)
        return hCloneProcess;
    else
        return NULL;

If hProcess is set, then it will be closed, regardless if the function succeed or not.

Please let me know that you think 😃

[JohnLaTwC]

Looking at the cleanup routine, I agree with you.

I first thought this might be the only place that it is closed, but I see that it is also closed in cleanup. No bug! 👍
https://github.com/helpsystems/nanodump/blob/07e44d2aa2f97cd298b2063fc344999840c8d2a7/source/handle.c#L992

[S4ntiagoP]

thanks again for looking at the code!