From: Rafal Harabien <rafalh@reactos.org>
Date: Fri, 25 Mar 2011 22:34:53 +0000 (+0000)
Subject: [WIN32K]
X-Git-Tag: backups/GSoC_2011/GSoC_Network@51549~40^2~15
X-Git-Url: https://git.reactos.org/?p=reactos.git;a=commitdiff_plain;h=0b986764d468c52017ecdd70022e4eada3327f7d;hp=547a7d215fa680ba6a8126fce2d59cefaf769263

[WIN32K]

Make sure strings returned by internal function RegQueryValue are NULL terminated

svn path=/trunk/; revision=51139
---

diff --git a/reactos/subsystems/win32/win32k/misc/registry.c b/reactos/subsystems/win32/win32k/misc/registry.c
index 86bac347f2f..455aa3f8a36 100644
--- a/reactos/subsystems/win32/win32k/misc/registry.c
+++ b/reactos/subsystems/win32/win32k/misc/registry.c
@@ -58,7 +58,7 @@ RegQueryValue(
     ULONG cbInfoSize, cbDataSize;
 
     /* Check if the local buffer is sufficient */
-    cbInfoSize = sizeof(KEY_VALUE_PARTIAL_INFORMATION) + *pcbValue;
+    cbInfoSize = FIELD_OFFSET(KEY_VALUE_PARTIAL_INFORMATION, Data) + *pcbValue;
     if (cbInfoSize <= sizeof(ajBuffer))
     {
         pInfo = (PVOID)ajBuffer;
@@ -89,8 +89,11 @@ RegQueryValue(
         /* Did we get the right type */
         if (pInfo->Type == ulType)
         {
-            /* Copy the contents to the caller */
-            RtlCopyMemory(pvData, pInfo->Data, min(*pcbValue, cbDataSize));
+            /* Copy the contents to the caller. Make sure strings are null terminated */
+            if (ulType == REG_SZ || ulType == REG_MULTI_SZ || ulType == REG_EXPAND_SZ)
+                RtlStringCbCopyNW((LPWSTR)pvData, *pcbValue, (LPWSTR)pInfo->Data, cbDataSize);
+            else
+                RtlCopyMemory(pvData, pInfo->Data, cbDataSize);
         }
         else
             Status = STATUS_OBJECT_TYPE_MISMATCH;