[PATCH 0/3] MR392: regedit: Code clean-up and invalid read fix

[PATCH 1/3] regedit: Remove unneeded valueDataLen override for DWORD values

[Hugh McMaster]

From: Hugh McMaster

---
 programs/regedit/edit.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/programs/regedit/edit.c b/programs/regedit/edit.c
index 47ce233039e..353925da90e 100644
--- a/programs/regedit/edit.c
+++ b/programs/regedit/edit.c
@@ -201,7 +201,7 @@ static LPWSTR read_value(HWND hwnd, HKEY hKey, LPCWSTR valueName, DWORD *lpType,
         error_code_messagebox(hwnd, IDS_BAD_VALUE, valueName);
         goto done;
     }
-    if ( *lpType == REG_DWORD ) valueDataLen = sizeof(DWORD);
+
     buffer = heap_xalloc(valueDataLen + sizeof(WCHAR));
     lRet = RegQueryValueExW(hKey, valueName, 0, 0, (LPBYTE)buffer, &valueDataLen);
     if (lRet) {

[PATCH 2/3] regedit: Correctly calculate REG_MULTI_SZ lengths before reading from the buffer

[Hugh McMaster]

From: Hugh McMaster

---
 programs/regedit/edit.c | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/programs/regedit/edit.c b/programs/regedit/edit.c
index 353925da90e..b70176fbbc2 100644
--- a/programs/regedit/edit.c
+++ b/programs/regedit/edit.c
@@ -312,12 +312,12 @@ BOOL ModifyValue(HWND hwnd, HKEY hKeyRoot, LPCWSTR keyPath, LPCWSTR valueName)
         WCHAR *tmpValueData = NULL;
         INT i, j, count;

-        for ( i = 0, count = 0; i < len - 1; i++)
+        for (i = 0, count = 0; i < len / sizeof(WCHAR); i++)
             if ( !stringValueData[i] && stringValueData[i + 1] )
                 count++;
-        tmpValueData = heap_xalloc((len + count) * sizeof(WCHAR));
+        tmpValueData = heap_xalloc(len + (count * sizeof(WCHAR)));

-        for ( i = 0, j = 0; i < len - 1; i++)
+        for ( i = 0, j = 0; i < len / sizeof(WCHAR); i++)
         {
             if ( !stringValueData[i] && stringValueData[i + 1])
             {
@@ -327,7 +327,7 @@ BOOL ModifyValue(HWND hwnd, HKEY hKeyRoot, LPCWSTR keyPath, LPCWSTR valueName)
             else
                 tmpValueData[j++] = stringValueData[i];
         }
-        tmpValueData[j] = stringValueData[i];
+
         heap_free(stringValueData);
         stringValueData = tmpValueData;
         tmpValueData = NULL;
@@ -337,7 +337,7 @@ BOOL ModifyValue(HWND hwnd, HKEY hKeyRoot, LPCWSTR keyPath, LPCWSTR valueName)
             len = lstrlenW( stringValueData );
             tmpValueData = heap_xalloc((len + 2) * sizeof(WCHAR));

-            for ( i = 0, j = 0; i < len - 1; i++)
+            for (i = 0, j = 0; i < len; i++)
             {
                 if ( stringValueData[i] == char1 && stringValueData[i + 1] == char2)
                 {
@@ -348,7 +348,7 @@ BOOL ModifyValue(HWND hwnd, HKEY hKeyRoot, LPCWSTR keyPath, LPCWSTR valueName)
                 else
                     tmpValueData[j++] = stringValueData[i];
             }
-            tmpValueData[j++] = stringValueData[i];
+
             tmpValueData[j++] = 0;
             tmpValueData[j++] = 0;
             heap_free(stringValueData);

[PATCH 3/3] regedit: Directly use RegQueryValueExW() instead of a helper function

[Hugh McMaster]

From: Hugh McMaster

---
 programs/regedit/edit.c | 7 +------
 1 file changed, 1 insertion(+), 6 deletions(-)

diff --git a/programs/regedit/edit.c b/programs/regedit/edit.c
index b70176fbbc2..ca512d3f557 100644
--- a/programs/regedit/edit.c
+++ b/programs/regedit/edit.c
@@ -178,11 +178,6 @@ static INT_PTR CALLBACK bin_modify_dlgproc(HWND hwndDlg, UINT uMsg, WPARAM wPara
     return FALSE;
 }

-static BOOL value_exists(HWND hwnd, HKEY hKey, const WCHAR *value_name)
-{
-    return !RegQueryValueExW(hKey, value_name, NULL, NULL, NULL, NULL);
-}
-
 static LPWSTR read_value(HWND hwnd, HKEY hKey, LPCWSTR valueName, DWORD *lpType, LONG *len)
 {
     DWORD valueDataLen;
@@ -523,7 +518,7 @@ BOOL RenameValue(HWND hwnd, HKEY hKeyRoot, LPCWSTR keyPath, LPCWSTR oldName, LPC
    return FALSE;
     }

-    if (value_exists(hwnd, hKey, newName)) {
+    if (RegQueryValueExW(hKey, newName, NULL, NULL, NULL, NULL)) {
         error_code_messagebox(hwnd, IDS_VALUE_EXISTS, oldName);
         goto done;
     }