[RTL]

Fix a nasty bug in RtlQueryRegistryValues, that caused memory corruption when the the key name or data had the "wrong" length.

svn path=/trunk/; revision=61624

diff --git a/reactos/lib/rtl/registry.c b/reactos/lib/rtl/registry.c
index 030fbef..2645484 100644 (file)
--- a/reactos/lib/rtl/registry.c
+++ b/reactos/lib/rtl/registry.c
@@ -211,7 +211,7 @@ RtlpCallQueryRegistryRoutine(IN PRTL_QUERY_REGISTRY_TABLE QueryTable,
 
             /* Check if we have space to copy the data */
             RequiredLength = KeyValueInfo->NameLength + sizeof(UNICODE_NULL);
-            if (SpareLength < RequiredLength)
+            if ((SpareData > DataEnd) || (SpareLength < RequiredLength))
             {
                 /* Fail and return the missing length */
                 *InfoSize = (ULONG)(SpareData - (PCHAR)KeyValueInfo) + RequiredLength;