From 101fe51b258bc4927dab5b92abc6a53e5e235c0a Mon Sep 17 00:00:00 2001 From: Hugh McMaster Date: Wed, 6 Jul 2022 22:27:48 +1000 Subject: [PATCH] regedit: Correctly calculate REG_MULTI_SZ size before reading from the buffer. Signed-off-by: Hugh McMaster --- programs/regedit/edit.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/programs/regedit/edit.c b/programs/regedit/edit.c index 353925da90e..b70176fbbc2 100644 --- a/programs/regedit/edit.c +++ b/programs/regedit/edit.c @@ -312,12 +312,12 @@ BOOL ModifyValue(HWND hwnd, HKEY hKeyRoot, LPCWSTR keyPath, LPCWSTR valueName) WCHAR *tmpValueData = NULL; INT i, j, count; - for ( i = 0, count = 0; i < len - 1; i++) + for (i = 0, count = 0; i < len / sizeof(WCHAR); i++) if ( !stringValueData[i] && stringValueData[i + 1] ) count++; - tmpValueData = heap_xalloc((len + count) * sizeof(WCHAR)); + tmpValueData = heap_xalloc(len + (count * sizeof(WCHAR))); - for ( i = 0, j = 0; i < len - 1; i++) + for ( i = 0, j = 0; i < len / sizeof(WCHAR); i++) { if ( !stringValueData[i] && stringValueData[i + 1]) { @@ -327,7 +327,7 @@ BOOL ModifyValue(HWND hwnd, HKEY hKeyRoot, LPCWSTR keyPath, LPCWSTR valueName) else tmpValueData[j++] = stringValueData[i]; } - tmpValueData[j] = stringValueData[i]; + heap_free(stringValueData); stringValueData = tmpValueData; tmpValueData = NULL; @@ -337,7 +337,7 @@ BOOL ModifyValue(HWND hwnd, HKEY hKeyRoot, LPCWSTR keyPath, LPCWSTR valueName) len = lstrlenW( stringValueData ); tmpValueData = heap_xalloc((len + 2) * sizeof(WCHAR)); - for ( i = 0, j = 0; i < len - 1; i++) + for (i = 0, j = 0; i < len; i++) { if ( stringValueData[i] == char1 && stringValueData[i + 1] == char2) { @@ -348,7 +348,7 @@ BOOL ModifyValue(HWND hwnd, HKEY hKeyRoot, LPCWSTR keyPath, LPCWSTR valueName) else tmpValueData[j++] = stringValueData[i]; } - tmpValueData[j++] = stringValueData[i]; + tmpValueData[j++] = 0; tmpValueData[j++] = 0; heap_free(stringValueData);