Jim Cameron : regedit: Fix crash importing large values from Unicode.

[Alexandre Julliard]

Module: wine
Branch: master
Commit: 5bd7e306b47b16a5c5c9edc1b3980b504aca47d9
URL:    http://source.winehq.org/git/wine.git/?a=commit;h=5bd7e306b47b16a5c5c9edc1b3...

Author: Jim Cameron 
Date:   Sun Mar  8 15:45:54 2009 +0000

regedit: Fix crash importing large values from Unicode.

---

programs/regedit/regproc.c |   28 +++++++++++++++++++---------
 1 files changed, 19 insertions(+), 9 deletions(-)

diff --git a/programs/regedit/regproc.c b/programs/regedit/regproc.c
index 47f9832..55b0d5f 100644
--- a/programs/regedit/regproc.c
+++ b/programs/regedit/regproc.c
@@ -732,12 +732,14 @@ static void processRegLinesW(FILE *in)
     ULONG lineSize       = REG_VAL_BUF_SIZE;
     size_t CharsInBuf = -1;

-    WCHAR* s; /* The pointer into line for where the current fgets should read */
+    WCHAR* s; /* The pointer into buf for where the current fgets should read */
+    WCHAR* line; /* The start of the current line */

buf = HeapAlloc(GetProcessHeap(), 0, lineSize * sizeof(WCHAR));
     CHECK_ENOUGH_MEMORY(buf);

s = buf;
+    line = buf;

while(!feof(in)) {
         size_t size_remaining;
@@ -757,6 +759,7 @@ static void processRegLinesW(FILE *in)
                 new_buffer = NULL;
             CHECK_ENOUGH_MEMORY(new_buffer);
             buf = new_buffer;
+            line = buf;
             s = buf + lineSize - size_remaining;
             lineSize = new_size;
             size_remaining = lineSize - (s-buf);
@@ -787,14 +790,21 @@ static void processRegLinesW(FILE *in)
         /* If we didn't read the eol nor the eof go around for the rest */
         while(1)
         {
-            s_eol = strchrW(s, '\n');
-
-            if(!s_eol)
+            s_eol = strchrW(line, '\n');
+
+            if(!s_eol) {
+                /* Move the stub of the line to the start of the buffer so
+                 * we get the maximum space to read into, and so we don't
+                 * have to recalculate 'line' if the buffer expands */
+                MoveMemory(buf, line, (strlenW(line)+1) * sizeof(WCHAR));
+                line = buf;
+                s = strchrW(line, '\0');
                 break;
+            }

/* If it is a comment line then discard it and go around again */
-            if (*s == '#') {
-                s = s_eol + 1;
+            if (*line == '#') {
+                line = s_eol + 1;
                 continue;
             }

@@ -811,7 +821,7 @@ static void processRegLinesW(FILE *in)
                 if(*(s_eol-1) == '\r')
                     s_eol--;

-                MoveMemory(s_eol - 1, NextLine, (CharsInBuf - (NextLine - buf) + 1)*sizeof(WCHAR));
+                MoveMemory(s_eol - 1, NextLine, (CharsInBuf - (NextLine - s) + 1)*sizeof(WCHAR));
                 CharsInBuf -= NextLine - s_eol + 1;
                 s_eol = 0;
                 continue;
@@ -827,8 +837,8 @@ static void processRegLinesW(FILE *in)
             if(!s_eol)
                 break;

-            processRegEntry(s, TRUE);
-            s = s_eol + 1;
+            processRegEntry(line, TRUE);
+            line = s_eol + 1;
             s_eol = 0;
             continue; /* That is the full virtual line */
         }