Martin Storsjö : win32u: Make sure that the stack buffer in set_multi_value_key is large enough.

[Alexandre Julliard]

Module: wine
Branch: master
Commit: 0cb279812546bedae68bc86210facd6c00dbb83f
URL:    https://gitlab.winehq.org/wine/wine/-/commit/0cb279812546bedae68bc86210facd6...

Author: Martin Storsjö <martin(a)martin.st>
Date:   Mon Oct 24 10:49:52 2022 +0300

win32u: Make sure that the stack buffer in set_multi_value_key is large enough.

This fixes stack overflows since
edecac8afdd04701314381b6386e0f7ac862e066.

Signed-off-by: Martin Storsjö <martin(a)martin.st>

---

 dlls/win32u/font.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/dlls/win32u/font.c b/dlls/win32u/font.c
index 6746f7fcb40..75189f8ec5a 100644
--- a/dlls/win32u/font.c
+++ b/dlls/win32u/font.c
@@ -3043,12 +3043,19 @@ static void update_font_association_info(void)
 
 static void set_multi_value_key( HKEY hkey, const WCHAR *name, const char *value, DWORD len )
 {
-    WCHAR valueW[256];
+    WCHAR *valueW;
+
+    if (!(valueW = malloc( len * sizeof(WCHAR) )))
+    {
+        ERR( "malloc of %d * WCHAR failed\n", len );
+        return;
+    }
     ascii_to_unicode( valueW, value, len );
     if (value)
         set_reg_value( hkey, name, REG_MULTI_SZ, valueW, len * sizeof(WCHAR) );
     else if (name)
         reg_delete_value( hkey, name );
+    free( valueW );
 }
 
 static void update_font_system_link_info(void)