From 0b986764d468c52017ecdd70022e4eada3327f7d Mon Sep 17 00:00:00 2001 From: Rafal Harabien Date: Fri, 25 Mar 2011 22:34:53 +0000 Subject: [PATCH] [WIN32K] Make sure strings returned by internal function RegQueryValue are NULL terminated svn path=/trunk/; revision=51139 --- reactos/subsystems/win32/win32k/misc/registry.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/reactos/subsystems/win32/win32k/misc/registry.c b/reactos/subsystems/win32/win32k/misc/registry.c index 86bac347f2f..455aa3f8a36 100644 --- a/reactos/subsystems/win32/win32k/misc/registry.c +++ b/reactos/subsystems/win32/win32k/misc/registry.c @@ -58,7 +58,7 @@ RegQueryValue( ULONG cbInfoSize, cbDataSize; /* Check if the local buffer is sufficient */ - cbInfoSize = sizeof(KEY_VALUE_PARTIAL_INFORMATION) + *pcbValue; + cbInfoSize = FIELD_OFFSET(KEY_VALUE_PARTIAL_INFORMATION, Data) + *pcbValue; if (cbInfoSize <= sizeof(ajBuffer)) { pInfo = (PVOID)ajBuffer; @@ -89,8 +89,11 @@ RegQueryValue( /* Did we get the right type */ if (pInfo->Type == ulType) { - /* Copy the contents to the caller */ - RtlCopyMemory(pvData, pInfo->Data, min(*pcbValue, cbDataSize)); + /* Copy the contents to the caller. Make sure strings are null terminated */ + if (ulType == REG_SZ || ulType == REG_MULTI_SZ || ulType == REG_EXPAND_SZ) + RtlStringCbCopyNW((LPWSTR)pvData, *pcbValue, (LPWSTR)pInfo->Data, cbDataSize); + else + RtlCopyMemory(pvData, pInfo->Data, cbDataSize); } else Status = STATUS_OBJECT_TYPE_MISMATCH;