Torge Matthies : ntdll: Calculate buffer sizes from registry structs correctly.

[Alexandre Julliard]

Module: wine
Branch: master
Commit: 4e19373c2fc049b7d4f4b215ad10513ee161edfe
URL:    https://source.winehq.org/git/wine.git/?a=commit;h=4e19373c2fc049b7d4f4b215a...

Author: Torge Matthies 
Date:   Sun May  1 01:57:07 2022 +0200

ntdll: Calculate buffer sizes from registry structs correctly.

Signed-off-by: Torge Matthies 
Signed-off-by: Alexandre Julliard

---

dlls/ntdll/reg.c         | 6 +++---
 dlls/ntdll/unix/system.c | 2 +-
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/dlls/ntdll/reg.c b/dlls/ntdll/reg.c
index 106ee620cda..283238559d1 100644
--- a/dlls/ntdll/reg.c
+++ b/dlls/ntdll/reg.c
@@ -93,7 +93,7 @@ NTSTATUS WINAPI RtlpNtEnumerateSubKey( HANDLE handle, UNICODE_STRING *out, ULONG

if (out->MaximumLength)
   {
-    dwLen = out->MaximumLength + sizeof(KEY_BASIC_INFORMATION);
+    dwLen = out->MaximumLength + offsetof(KEY_BASIC_INFORMATION, Name);
     info = RtlAllocateHeap( GetProcessHeap(), 0, dwLen );
     if (!info)
       return STATUS_NO_MEMORY;
@@ -105,7 +105,7 @@ NTSTATUS WINAPI RtlpNtEnumerateSubKey( HANDLE handle, UNICODE_STRING *out, ULONG
   }

ret = NtEnumerateKey( handle, index, KeyBasicInformation, info, dwLen, &dwResultLen );
-  dwResultLen -= sizeof(KEY_BASIC_INFORMATION);
+  dwResultLen -= offsetof(KEY_BASIC_INFORMATION, Name);

if (ret == STATUS_BUFFER_OVERFLOW)
     out->Length = dwResultLen;
@@ -138,7 +138,7 @@ NTSTATUS WINAPI RtlpNtQueryValueKey( HANDLE handle, ULONG *result_type, PBYTE de
     UNICODE_STRING name;
     NTSTATUS ret;
     DWORD dwResultLen;
-    DWORD dwLen = sizeof (KEY_VALUE_PARTIAL_INFORMATION) + (result_len ? *result_len : 0);
+    DWORD dwLen = offsetof(KEY_VALUE_PARTIAL_INFORMATION, Data[result_len ? *result_len : 0]);

info = RtlAllocateHeap( GetProcessHeap(), 0, dwLen );
     if (!info)
diff --git a/dlls/ntdll/unix/system.c b/dlls/ntdll/unix/system.c
index ee91441794e..87cc8b9c3a4 100644
--- a/dlls/ntdll/unix/system.c
+++ b/dlls/ntdll/unix/system.c
@@ -2095,7 +2095,7 @@ static BOOL reg_query_value( HKEY key, LPCWSTR name, DWORD type, void *data, DWO
     UNICODE_STRING nameW;
     KEY_VALUE_PARTIAL_INFORMATION *info = (KEY_VALUE_PARTIAL_INFORMATION *)buf;

-    if (count > sizeof(buf) - sizeof(KEY_VALUE_PARTIAL_INFORMATION)) return FALSE;
+    if (count > sizeof(buf) - offsetof(KEY_VALUE_PARTIAL_INFORMATION, Data)) return FALSE;

nameW.Buffer = (WCHAR *)name;
     nameW.Length = wcslen( name ) * sizeof(WCHAR);