From c42d4ae0f0df7cd883ea61d096f1202310057b2b Mon Sep 17 00:00:00 2001
From: Roel Messiant <roelmessiant@gmail.com>
Date: Sun, 4 Dec 2011 19:19:33 +0000
Subject: [PATCH] [REGEDIT] - Prevent buffer overflow when creating the display
 value for a value of type REG_MULTI_SZ. - Prevent processing excess data when
 preparing a value of type REG_MULTI_SZ for editing.

svn path=/trunk/; revision=54590
---
 reactos/base/applications/regedit/edit.c     | 2 +-
 reactos/base/applications/regedit/listview.c | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/reactos/base/applications/regedit/edit.c b/reactos/base/applications/regedit/edit.c
index cd773455c4d..84ae0aba970 100644
--- a/reactos/base/applications/regedit/edit.c
+++ b/reactos/base/applications/regedit/edit.c
@@ -1127,7 +1127,7 @@ BOOL ModifyValue(HWND hwnd, HKEY hKey, LPCTSTR valueName, BOOL EditBin)
             size_t llen, listlen, nl_len;
             LPTSTR src, lines = NULL;
 
-            if (!(stringValueData = HeapAlloc(GetProcessHeap(), 0, valueDataLen)))
+            if (!(stringValueData = HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, valueDataLen + sizeof(TCHAR))))
             {
                 error(hwnd, IDS_TOO_BIG_VALUE, valueDataLen);
                 goto done;
diff --git a/reactos/base/applications/regedit/listview.c b/reactos/base/applications/regedit/listview.c
index c9408f2c327..864ca388f49 100644
--- a/reactos/base/applications/regedit/listview.c
+++ b/reactos/base/applications/regedit/listview.c
@@ -186,7 +186,7 @@ static void AddEntryToList(HWND hwndLV, LPTSTR Name, DWORD dwValType, void* ValB
             if(dwCount >= 2)
             {
                 src = (LPTSTR)ValBuf;
-                str = HeapAlloc(GetProcessHeap(), 0, dwCount);
+                str = HeapAlloc(GetProcessHeap(), 0, dwCount + sizeof(TCHAR));
                 if(str != NULL)
                 {
                     *str = _T('\0');