Hugh McMaster : regedit: Store the data from a listview subitem in a valid memory address.

[Alexandre Julliard]

Module: wine
Branch: master
Commit: 5d9a4c4dbd85cd97acae0d9f0191415bf4b30673
URL:    http://source.winehq.org/git/wine.git/?a=commit;h=5d9a4c4dbd85cd97acae0d9f01...

Author: Hugh McMaster 
Date:   Fri Jul 28 13:22:27 2017 +0000

regedit: Store the data from a listview subitem in a valid memory address.

Signed-off-by: Hugh McMaster 
Signed-off-by: Alexandre Julliard

---

programs/regedit/childwnd.c |  1 +
 programs/regedit/listview.c | 16 ++++++++++------
 2 files changed, 11 insertions(+), 6 deletions(-)

diff --git a/programs/regedit/childwnd.c b/programs/regedit/childwnd.c
index d6a7d51..7a5633f 100644
--- a/programs/regedit/childwnd.c
+++ b/programs/regedit/childwnd.c
@@ -397,6 +397,7 @@ static int listview_notify(HWND hWnd, UINT message, WPARAM wParam, LPARAM lParam
             LINE_INFO *info = (LINE_INFO *)nmlv->lParam;

heap_free(info->name);
+            heap_free(info->val);
             heap_free(info);
             break;
         }
diff --git a/programs/regedit/listview.c b/programs/regedit/listview.c
index 238a2c7..e1e8c7f 100644
--- a/programs/regedit/listview.c
+++ b/programs/regedit/listview.c
@@ -152,23 +152,27 @@ void format_value_data(HWND hwndLV, int index, DWORD type, void *data, DWORD siz

int AddEntryToList(HWND hwndLV, WCHAR *Name, DWORD dwValType, void *ValBuf, DWORD dwCount, int pos)
 {
+    LINE_INFO *linfo;
     LVITEMW item = { 0 };
-    LINE_INFO* linfo;
     int index;

-    linfo = HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, sizeof(LINE_INFO) + dwCount);
+    linfo = heap_xalloc(sizeof(LINE_INFO));
     linfo->dwValType = dwValType;
     linfo->val_len = dwCount;
-    CopyMemory(&linfo[1], ValBuf, dwCount);
-    
+
     if (Name)
     {
         linfo->name = heap_xalloc((lstrlenW(Name) + 1) * sizeof(WCHAR));
         lstrcpyW(linfo->name, Name);
-    } else
+    }
+    else linfo->name = NULL;
+
+    if (ValBuf && dwCount)
     {
-        linfo->name = NULL;
+        linfo->val = heap_xalloc(dwCount);
+        memcpy(&linfo->val, ValBuf, dwCount);
     }
+    else linfo->val = NULL;

item.mask = LVIF_TEXT | LVIF_PARAM | LVIF_STATE | LVIF_IMAGE;
     item.iItem = (pos == -1) ? SendMessageW(hwndLV, LVM_GETITEMCOUNT, 0, 0) : pos;