Fix small race in the sandbox

sandbox/win/src/registry_policy.cc

 // Copyright (c) 2006-2008 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include <string>
 
 #include "sandbox/win/src/registry_policy.h"
 
 #include "base/logging.h"
 #include "sandbox/win/src/ipc_tags.h"
@@ skipping 60 matching lines @@
   HANDLE local_handle = INVALID_HANDLE_VALUE;
   NTSTATUS status = NtCreateKey(&local_handle, desired_access, obj_attributes,
                                 title_index, class_name, create_options,
                                 disposition);
   if (!NT_SUCCESS(status))
     return status;
 
   if (!::DuplicateHandle(::GetCurrentProcess(), local_handle,
                          target_process, target_key_handle, 0, FALSE,
                          DUPLICATE_CLOSE_SOURCE | DUPLICATE_SAME_ACCESS)) {
-    ::CloseHandle(local_handle);
     return STATUS_ACCESS_DENIED;
   }
   return STATUS_SUCCESS;
 }
 
 NTSTATUS NtOpenKeyInTarget(HANDLE* target_key_handle,
                            ACCESS_MASK desired_access,
                            OBJECT_ATTRIBUTES* obj_attributes,
                            HANDLE target_process) {
   NtOpenKeyFunction NtOpenKey = NULL;
   ResolveNTFunctionPtr("NtOpenKey", &NtOpenKey);
 
   if (MAXIMUM_ALLOWED & desired_access) {
     NTSTATUS status = TranslateMaximumAllowed(obj_attributes, &desired_access);
     if (!NT_SUCCESS(status))
       return STATUS_ACCESS_DENIED;
   }
 
   HANDLE local_handle = INVALID_HANDLE_VALUE;
   NTSTATUS status = NtOpenKey(&local_handle, desired_access, obj_attributes);
 
   if (!NT_SUCCESS(status))
     return status;
 
   if (!::DuplicateHandle(::GetCurrentProcess(), local_handle,
                          target_process, target_key_handle, 0, FALSE,
                          DUPLICATE_CLOSE_SOURCE | DUPLICATE_SAME_ACCESS)) {
-    ::CloseHandle(local_handle);
     return STATUS_ACCESS_DENIED;
   }
   return STATUS_SUCCESS;
 }
 
 }
 
 namespace sandbox {
 
 bool RegistryPolicy::GenerateRules(const wchar_t* name,
@@ skipping 98 matching lines @@
   UNICODE_STRING uni_name = {0};
   OBJECT_ATTRIBUTES obj_attributes = {0};
   InitObjectAttribs(key, attributes, root_directory, &obj_attributes,
                     &uni_name);
   *nt_status = NtOpenKeyInTarget(handle, desired_access, &obj_attributes,
                                 client_info.process);
   return true;
 }
 
 }  // namespace sandbox