kernel32: Fixed buffer overrun in get_registry_locale_info.

63ca94c4 · Alexandre Julliard · 6987a4b4 · 63ca94c4
Commit 63ca94c4 authored Nov 09, 2006 by Alexandre Julliard
Hide whitespace changes
Inline Side-by-side

Showing with 10 additions and 7 deletions

locale.c dlls/kernel32/locale.c +10 -7

No files found.
--- a/dlls/kernel32/locale.c
+++ b/dlls/kernel32/locale.c
@@ -804,7 +804,6 @@ static INT get_registry_locale_info( LPCWSTR value, LPWSTR buffer, INT len )
    }
    status = NtQueryValueKey( hkey, &nameW, KeyValuePartialInformation, info, size, &size );
-    if (status == STATUS_BUFFER_OVERFLOW && !buffer) status = 0;
    if (!status)
    {
@@ -825,14 +824,18 @@ static INT get_registry_locale_info( LPCWSTR value, LPWSTR buffer, INT len )
            buffer[ret-1] = 0;
        }
    }
+    else if (status == STATUS_BUFFER_OVERFLOW && !buffer)
+    {
+        ret = (size - info_size) / sizeof(WCHAR) + 1;
+    }
+    else if (status == STATUS_OBJECT_NAME_NOT_FOUND)
+    {
+        ret = -1;
+    }
    else
    {
-        if (status == STATUS_OBJECT_NAME_NOT_FOUND) ret = -1;
+        SetLastError( RtlNtStatusToDosError(status) );
-        else
+        ret = 0;
-        {
-            SetLastError( RtlNtStatusToDosError(status) );
-            ret = 0;
-        }
    }
    NtClose( hkey );
    HeapFree( GetProcessHeap(), 0, info );