Alexandre Julliard : advapi32: Fix null termination in RegQueryInfoKeyA.

[Alexandre Julliard]

Module: wine
Branch: master
Commit: 303daeef58b7fe56ef991dde8504d65c11924937
URL:    http://source.winehq.org/git/wine.git/?a=commit;h=303daeef58b7fe56ef991dde85...

Author: Alexandre Julliard <julliard(a)winehq.org>
Date:   Tue Mar 15 14:06:29 2016 +0900

advapi32: Fix null termination in RegQueryInfoKeyA.

Signed-off-by: Alexandre Julliard <julliard(a)winehq.org>

---

 dlls/advapi32/registry.c       |  2 +-
 dlls/advapi32/tests/registry.c | 22 ++++++++++++++++++++++
 2 files changed, 23 insertions(+), 1 deletion(-)

diff --git a/dlls/advapi32/registry.c b/dlls/advapi32/registry.c
index aa451b1..7992384 100644
--- a/dlls/advapi32/registry.c
+++ b/dlls/advapi32/registry.c
@@ -1162,12 +1162,12 @@ LSTATUS WINAPI RegQueryInfoKeyA( HKEY hkey, LPSTR class, LPDWORD class_len, LPDW
                                 (WCHAR *)(buf_ptr + info->ClassOffset), info->ClassLength );
         if (len)
         {
-            class[len - 1] = 0;
             if (*class_len + 1 > len)
             {
                 status = STATUS_BUFFER_OVERFLOW;
                 *class_len -= 1;
             }
+            class[*class_len] = 0;
         }
     }
     else status = STATUS_SUCCESS;
diff --git a/dlls/advapi32/tests/registry.c b/dlls/advapi32/tests/registry.c
index c2b0e12..f877b36 100644
--- a/dlls/advapi32/tests/registry.c
+++ b/dlls/advapi32/tests/registry.c
@@ -1987,6 +1987,17 @@ static void test_reg_query_info(void)
        "classbuffer = \"%.*s\", expected %s\n",
        (int)sizeof(classbuffer), classbuffer, expectbuffer);
 
+    memset(classbuffer, 0x55, sizeof(classbuffer));
+    classlen = 0xdeadbeef;
+    ret = RegQueryInfoKeyA(subkey, classbuffer, &classlen, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL);
+    ok(ret == ERROR_SUCCESS, "ret = %d\n", ret);
+    ok(classlen == sizeof(subkey_class) - 1, "classlen = %u\n", classlen);
+    memset(expectbuffer, 0x55, sizeof(expectbuffer));
+    strcpy(expectbuffer, subkey_class);
+    ok(!memcmp(classbuffer, expectbuffer, sizeof(classbuffer)),
+       "classbuffer = \"%.*s\", expected %s\n",
+       (int)sizeof(classbuffer), classbuffer, expectbuffer);
+
     memset(classbufferW, 0x55, sizeof(classbufferW));
     classlen = sizeof(subkey_class);
     ret = RegQueryInfoKeyW(subkey, classbufferW, &classlen, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL);
@@ -1998,6 +2009,17 @@ static void test_reg_query_info(void)
        "classbufferW = %s, expected %s\n",
        wine_dbgstr_wn(classbufferW, sizeof(classbufferW) / sizeof(WCHAR)), wine_dbgstr_w(expectbufferW));
 
+    memset(classbufferW, 0x55, sizeof(classbufferW));
+    classlen = 0xdeadbeef;
+    ret = RegQueryInfoKeyW(subkey, classbufferW, &classlen, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL);
+    ok(ret == ERROR_SUCCESS, "ret = %d\n", ret);
+    ok(classlen == sizeof(subkey_class) - 1, "classlen = %u\n", classlen);
+    memset(expectbufferW, 0x55, sizeof(expectbufferW));
+    lstrcpyW(expectbufferW, subkey_classW);
+    ok(!memcmp(classbufferW, expectbufferW, sizeof(classbufferW)),
+       "classbufferW = %s, expected %s\n",
+       wine_dbgstr_wn(classbufferW, sizeof(classbufferW) / sizeof(WCHAR)), wine_dbgstr_w(expectbufferW));
+
     RegDeleteKeyA(subsubkey, "");
     RegCloseKey(subsubkey);
     RegDeleteKeyA(subkey, "");