[PATCH 4/4] mf: Fix string array access for registration data helpers.

[Nikolay Sivov]

Signed-off-by: Nikolay Sivov 
---
 dlls/mf/main.c | 17 +++++++++--------
 1 file changed, 9 insertions(+), 8 deletions(-)

diff --git a/dlls/mf/main.c b/dlls/mf/main.c
index 8e42837b46..ac80c51016 100644
--- a/dlls/mf/main.c
+++ b/dlls/mf/main.c
@@ -1090,7 +1090,7 @@ BOOL WINAPI DllMain(HINSTANCE instance, DWORD reason, LPVOID reserved)
     return TRUE;
 }

-static HRESULT prop_string_vector_append(PROPVARIANT *vector, unsigned int *count, BOOL unique, const WCHAR *str)
+static HRESULT prop_string_vector_append(PROPVARIANT *vector, unsigned int *capacity, BOOL unique, const WCHAR *str)
 {
     WCHAR *ptrW;
     int len, i;
@@ -1104,17 +1104,17 @@ static HRESULT prop_string_vector_append(PROPVARIANT *vector, unsigned int *coun
         }
     }

-    if (!vector->calpwstr.cElems || *count > vector->calpwstr.cElems - 1)
+    if (!*capacity || *capacity - 1 < vector->calpwstr.cElems)
     {
         unsigned int new_count;
         WCHAR **ptr;

-        new_count = *count ? *count * 2 : 10;
+        new_count = *capacity ? *capacity * 2 : 10;
         ptr = CoTaskMemRealloc(vector->calpwstr.pElems, new_count * sizeof(*vector->calpwstr.pElems));
         if (!ptr)
             return E_OUTOFMEMORY;
         vector->calpwstr.pElems = ptr;
-        *count = new_count;
+        *capacity = new_count;
     }

len = lstrlenW(str);
@@ -1129,12 +1129,14 @@ static HRESULT prop_string_vector_append(PROPVARIANT *vector, unsigned int *coun

static int __cdecl qsort_string_compare(const void *a, const void *b)
 {
-    return lstrcmpW(a, b);
+    const WCHAR *left = *(const WCHAR **)a, *right = *(const WCHAR **)b;
+    return lstrcmpW(left, right);
 }

static HRESULT mf_get_handler_strings(const WCHAR *path, WCHAR filter, unsigned int maxlen, PROPVARIANT *dst)
 {
     static const HKEY hkey_roots[2] = { HKEY_CURRENT_USER, HKEY_LOCAL_MACHINE };
+    unsigned int capacity = 0, count, size;
     HRESULT hr = S_OK;
     int i, index;
     WCHAR *buffW;
@@ -1148,8 +1150,6 @@ static HRESULT mf_get_handler_strings(const WCHAR *path, WCHAR filter, unsigned

for (i = 0; i < ARRAY_SIZE(hkey_roots); ++i)
     {
-        unsigned int count;
-        DWORD size;
         HKEY hkey;

if (RegOpenKeyW(hkey_roots[i], path, &hkey))
@@ -1162,7 +1162,8 @@ static HRESULT mf_get_handler_strings(const WCHAR *path, WCHAR filter, unsigned
         {
             if (filter && !wcschr(buffW, filter))
                 continue;
-            if (FAILED(hr = prop_string_vector_append(dst, &count, i > 0, buffW)))
+
+            if (FAILED(hr = prop_string_vector_append(dst, &capacity, i > 0, buffW)))
                 break;
             size = maxlen;
         }