Check for buffer overflows on data returns from RegQueryValueExA.

c0e3db95 · Marcus Meissner · Alexandre Julliard · c6f0a4ed · c0e3db95
Commit c0e3db95 authored Oct 13, 2000 by Marcus Meissner Committed by Alexandre Julliard Oct 13, 2000
Hide whitespace changes
Inline Side-by-side

Showing with 5 additions and 1 deletion

registry.c memory/registry.c +5 -1

No files found.
--- a/memory/registry.c
+++ b/memory/registry.c
@@ -923,7 +923,11 @@ DWORD WINAPI RegQueryValueExA( HKEY hkey, LPCSTR name, LPDWORD reserved, LPDWORD
                }
                total_size = len + info_size;
            }
-            else if (data) memcpy( data, buf_ptr + info_size, total_size - info_size );
+            else if (data)
+            {
+                if (total_size - info_size > *count) status = STATUS_BUFFER_OVERFLOW;
+                else memcpy( data, buf_ptr + info_size, total_size - info_size );
+            }
        }
        else if (status != STATUS_BUFFER_OVERFLOW) goto done;
    }