[Bug 20758] New: Missing nul termination in string passed to callback of RtlQueryRegistryValues()?

http://bugs.winehq.org/show_bug.cgi?id=20758

Summary: Missing nul termination in string passed to callback
                    of RtlQueryRegistryValues()?
           Product: Wine
           Version: 1.1.33
          Platform: PC
        OS/Version: Linux
            Status: NEW
          Keywords: source, testcase
          Severity: normal
          Priority: P2
         Component: ntdll
        AssignedTo: [e-mail]
        ReportedBy: [e-mail]

http://kegel.com/wine/valgrind/logs/2009-11-18-21.51/vg-ntdll_reg.txt
shows the error message

Invalid read of size 2
    at  strlenW (unicode.h:216)
    by  lstrlenW (string.c:214)
    by  QueryRoutine (reg.c:201)
    by  RTL_ReportRegistryValue (reg.c:992)
    by  RtlQueryRegistryValues (reg.c:1231)
    by  test_RtlQueryRegistryValues (reg.c:326)
  Address 0x7f03c184 is 0 bytes after a block of size 52 alloc'd
    at  notify_alloc (heap.c:279)
    by  RtlAllocateHeap (heap.c:1521)
    by  RtlQueryRegistryValues (reg.c:1226)
    by  test_RtlQueryRegistryValues (reg.c:326)

It looks like an argument between len and null-terminated strings.
RtlQueryRegistryValues calls a user-supplied callback whose first
parameter is to a nul-terminated string... but it passes pInfo->Name,
which is not nul-terminated.  (It comes from NtEnumerateValueKey, 
and has a corresponding NameLength member.)

So... either we need to copy Name to a new buffer and terminate
it before calling the callback, or NtEnumerateValueKey needs
to silently nul-terminate Name.  I guess it's time for another
conformance test.

(This error was seen before by Valgrind, but with a slightly
less informative description.)

[Bug 20758] Missing nul termination in string passed to callback of RtlQueryRegistryValues()?

http://bugs.winehq.org/show_bug.cgi?id=20758

--- Comment #1 from Nikolay Sivov  2010-12-19 18:09:23 CST ---
I guess Rob fixed this a year ago:

http://source.winehq.org/git/wine.git/?a=commit;h=3d0f56fb371f3c983ea0c9ab43...

This could be closed safely I think, but a new valgrind run will be nice too.

[Bug 20758] Missing nul termination in string passed to callback of RtlQueryRegistryValues()?

http://bugs.winehq.org/show_bug.cgi?id=20758

Nikolay Sivov  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
         Resolution|                            |FIXED

--- Comment #2 from Nikolay Sivov  2011-08-07 11:00:39 CDT ---
I see no leaks in 'reg' tests with 1.3.26, marking fixed.

[Bug 20758] Missing nul termination in string passed to callback of RtlQueryRegistryValues()?

http://bugs.winehq.org/show_bug.cgi?id=20758

Alexandre Julliard  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|RESOLVED                    |CLOSED

--- Comment #3 from Alexandre Julliard  2011-08-26 13:24:46 CDT ---
Closing bugs fixed in 1.3.27.