Alex Henrie : ntdll: Only allow string default values with RTL_QUERY_REGISTRY_DIRECT.

[Alexandre Julliard]

Module: wine
Branch: master
Commit: 4db02f76190a52acd12af745829dbb35582440cb
URL:    https://gitlab.winehq.org/wine/wine/-/commit/4db02f76190a52acd12af745829dbb3...

Author: Alex Henrie 
Date:   Thu Jun 13 22:48:49 2024 -0600

ntdll: Only allow string default values with RTL_QUERY_REGISTRY_DIRECT.

---

dlls/ntdll/reg.c       | 16 ++++++++++++----
 dlls/ntdll/tests/reg.c | 27 ++++++++++++++++++++-------
 2 files changed, 32 insertions(+), 11 deletions(-)

diff --git a/dlls/ntdll/reg.c b/dlls/ntdll/reg.c
index df8763835ad..044bf32f460 100644
--- a/dlls/ntdll/reg.c
+++ b/dlls/ntdll/reg.c
@@ -263,10 +263,18 @@ static NTSTATUS RTL_ReportRegistryValue(PKEY_VALUE_FULL_INFORMATION pInfo,
         {
             if (pQuery->QueryRoutine)
                 return STATUS_INVALID_PARAMETER;
-            if (str->MaximumLength < default_size)
-                return STATUS_BUFFER_TOO_SMALL;
-            memcpy(str->Buffer, pQuery->DefaultData, default_size);
-            str->Length = default_size - sizeof(WCHAR);
+
+            if (pQuery->DefaultType == REG_SZ || pQuery->DefaultType == REG_EXPAND_SZ ||
+                pQuery->DefaultType == REG_MULTI_SZ || pQuery->DefaultType == REG_LINK)
+            {
+                if (!pQuery->DefaultData)
+                    return STATUS_DATA_OVERRUN;
+                if (str->MaximumLength < default_size)
+                    return STATUS_BUFFER_TOO_SMALL;
+                memcpy(str->Buffer, pQuery->DefaultData, default_size);
+                str->Length = default_size - sizeof(WCHAR);
+            }
+
             return STATUS_SUCCESS;
         }
         else if (pQuery->QueryRoutine)
diff --git a/dlls/ntdll/tests/reg.c b/dlls/ntdll/tests/reg.c
index d569f1f4d19..b6763e6e1d2 100644
--- a/dlls/ntdll/tests/reg.c
+++ b/dlls/ntdll/tests/reg.c
@@ -2601,7 +2601,7 @@ static NTSTATUS WINAPI query_routine(const WCHAR *value_name, ULONG value_type,
             expected_size = 0;
         }

-        if (!expected_size && expected_data)
+        if (!expected_size && expected_data && (expected_type == REG_SZ || expected_type == REG_EXPAND_SZ))
             expected_size = (wcslen(expected_data) + 1) * sizeof(WCHAR);

todo_wine_if(test->flags & WINE_TODO_TYPE)
@@ -2611,11 +2611,11 @@ static NTSTATUS WINAPI query_routine(const WCHAR *value_name, ULONG value_type,
         ok(value_data_size == expected_size, "Expected size %lu, got %lu\n", expected_size, value_data_size);

todo_wine_if(test->flags & WINE_TODO_DATA && !(test->flags & SPLIT_MULTI && query_routine_calls == 0))
-        if (expected_data)
+        if (expected_data == query->DefaultData || expected_data == NULL)
+            ok(value_data == expected_data, "Expected data %p, got %p\n", expected_data, value_data);
+        else
             ok(!memcmp(value_data, expected_data, value_data_size),
                "Expected data %s, got %s\n", debugstr_w(expected_data), debugstr_w(value_data));
-        else
-            ok(!value_data, "Expected null data\n");
     }

query_routine_calls++;
@@ -2731,6 +2731,10 @@ static struct query_reg_values_test query_reg_values_tests[] =
         {{ query_routine, 0, (WCHAR*)L"I don't exist", NULL, REG_MULTI_SZ, (WCHAR*)L"Brussels\0Paris\0Madrid\0" }},
         STATUS_SUCCESS, 3, EXPECT_DEFAULT_DATA | SPLIT_MULTI | WINE_TODO_CALLS | WINE_TODO_TYPE | WINE_TODO_SIZE
     },
+    {
+        {{ query_routine, 0, (WCHAR*)L"I don't exist", NULL, REG_DWORD, (WCHAR*)0xdeadbeef }},
+        STATUS_SUCCESS, 1, EXPECT_DEFAULT_DATA
+    },
     {
         {{ NULL, RTL_QUERY_REGISTRY_DIRECT, (WCHAR*)L"I don't exist",
            &query_reg_values_direct_str, REG_SZ, (WCHAR*)L"Some default", 4 * sizeof(WCHAR) }},
@@ -2764,12 +2768,18 @@ static struct query_reg_values_test query_reg_values_tests[] =
     {
         {{ NULL, RTL_QUERY_REGISTRY_DIRECT, (WCHAR*)L"I don't exist",
            &query_reg_values_direct_str, REG_SZ }},
-        STATUS_DATA_OVERRUN, 0, WINE_TODO_RET | WINE_TODO_SIZE, REG_NONE, NULL, -1
+        STATUS_DATA_OVERRUN, 0, 0, REG_NONE, NULL, -1
     },
     {
         {{ NULL, RTL_QUERY_REGISTRY_DIRECT, (WCHAR*)L"I don't exist",
            &query_reg_values_direct_str, REG_NONE, (WCHAR*)L"Some default" }},
-        STATUS_SUCCESS, 0, WINE_TODO_SIZE, REG_NONE, NULL, -1
+        STATUS_SUCCESS, 0, 0, REG_NONE, NULL, -1
+    },
+    /* DIRECT additionally requires the default value to be a string */
+    {
+        {{ NULL, RTL_QUERY_REGISTRY_DIRECT, (WCHAR*)L"I don't exist",
+           &query_reg_values_direct_str, REG_DWORD, (WCHAR*)0xdeadbeef }},
+        STATUS_SUCCESS, 0, 0, REG_NONE, NULL, -1
     },
     /* REQUIRED fails if the value doesn't exist and there is no default */
     {
@@ -2820,6 +2830,7 @@ static void test_RtlQueryRegistryValues(void)
         RTL_QUERY_REGISTRY_TABLE *query;
         const WCHAR *expected_data;
         ULONG expected_size;
+        ULONG expected_type;

winetest_push_context("%u/%Iu", i, ARRAY_SIZE(query_reg_values_tests) - 1);

@@ -2850,16 +2861,18 @@ static void test_RtlQueryRegistryValues(void)
             {
                 if (test->flags & EXPECT_DEFAULT_DATA)
                 {
+                    expected_type = query->DefaultType;
                     expected_data = query->DefaultData;
                     expected_size = query->DefaultLength;
                 }
                 else
                 {
+                    expected_type = test->expected_type;
                     expected_data = test->expected_data;
                     expected_size = test->expected_data_size;
                 }

-                if (!expected_size && expected_data)
+                if (!expected_size && expected_data && (expected_type == REG_SZ || expected_type == REG_EXPAND_SZ))
                     expected_size = (wcslen(expected_data) + 1) * sizeof(WCHAR);
                 else if (expected_size == -1)
                     expected_size = query_reg_values_direct_str.MaximumLength;