[PATCH] Regedit: Stop crash when modifying a DWORD value.

[Alistair Leslie-Hughes]

Wine-Bug: https://bugs.winehq.org/show_bug.cgi?id=19098
Signed-off-by: Alistair Leslie-Hughes <leslie_alistair(a)hotmail.com>
---
 programs/regedit/edit.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/programs/regedit/edit.c b/programs/regedit/edit.c
index a3cf17b..d26b4ff 100644
--- a/programs/regedit/edit.c
+++ b/programs/regedit/edit.c
@@ -282,8 +282,12 @@ BOOL ModifyValue(HWND hwnd, HKEY hKeyRoot, LPCWSTR keyPath, LPCWSTR valueName)
             else error_code_messagebox(hwnd, IDS_SET_VALUE_FAILED);
         }
     } else if ( type == REG_DWORD ) {
+        WCHAR buffer[256];
         static const WCHAR x[] = {'%','x',0};
-        wsprintfW(stringValueData, x, *((DWORD*)stringValueData));
+        DWORD value = *((DWORD*)stringValueData);
+        heap_free(stringValueData);
+        stringValueData = buffer;
+        wsprintfW(stringValueData, x, value);
 	if (DialogBoxW(0, MAKEINTRESOURCEW(IDD_EDIT_DWORD), hwnd, modify_dlgproc) == IDOK) {
 	    DWORD val;
 	    CHAR* valueA = GetMultiByteString(stringValueData);
@@ -294,6 +298,7 @@ BOOL ModifyValue(HWND hwnd, HKEY hKeyRoot, LPCWSTR keyPath, LPCWSTR valueName)
 	    }
 	    heap_free(valueA);
 	}
+        stringValueData = NULL;
     } else if ( type == REG_MULTI_SZ ) {
         WCHAR char1 = '\r', char2 = '\n';
         WCHAR *tmpValueData = NULL;
-- 
1.9.1

[Alexandre Julliard]

Alistair Leslie-Hughes <leslie_alistair(a)hotmail.com> writes:
> @@ -282,8 +282,12 @@ BOOL ModifyValue(HWND hwnd, HKEY hKeyRoot, LPCWSTR keyPath, LPCWSTR valueName)
>              else error_code_messagebox(hwnd, IDS_SET_VALUE_FAILED);
>          }
>      } else if ( type == REG_DWORD ) {
> +        WCHAR buffer[256];
>          static const WCHAR x[] = {'%','x',0};
> -        wsprintfW(stringValueData, x, *((DWORD*)stringValueData));
> +        DWORD value = *((DWORD*)stringValueData);
> +        heap_free(stringValueData);
> +        stringValueData = buffer;

This can't work, it needs to be allocated on the heap.

-- 
Alexandre Julliard
julliard(a)winehq.org