[PATCH] Regedit: Stop crash when modifying a DWORD value.

[Alistair Leslie-Hughes]

Wine-Bug: https://bugs.winehq.org/show_bug.cgi?id=19098
Signed-off-by: Alistair Leslie-Hughes 
---
 programs/regedit/edit.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/programs/regedit/edit.c b/programs/regedit/edit.c
index a3cf17b..d26b4ff 100644
--- a/programs/regedit/edit.c
+++ b/programs/regedit/edit.c
@@ -282,8 +282,12 @@ BOOL ModifyValue(HWND hwnd, HKEY hKeyRoot, LPCWSTR keyPath, LPCWSTR valueName)
             else error_code_messagebox(hwnd, IDS_SET_VALUE_FAILED);
         }
     } else if ( type == REG_DWORD ) {
+        WCHAR buffer[256];
         static const WCHAR x[] = {'%','x',0};
-        wsprintfW(stringValueData, x, *((DWORD*)stringValueData));
+        DWORD value = *((DWORD*)stringValueData);
+        heap_free(stringValueData);
+        stringValueData = buffer;
+        wsprintfW(stringValueData, x, value);
    if (DialogBoxW(0, MAKEINTRESOURCEW(IDD_EDIT_DWORD), hwnd, modify_dlgproc) == IDOK) {
        DWORD val;
        CHAR* valueA = GetMultiByteString(stringValueData);
@@ -294,6 +298,7 @@ BOOL ModifyValue(HWND hwnd, HKEY hKeyRoot, LPCWSTR keyPath, LPCWSTR valueName)
        }
        heap_free(valueA);
    }
+        stringValueData = NULL;
     } else if ( type == REG_MULTI_SZ ) {
         WCHAR char1 = '\r', char2 = '\n';
         WCHAR *tmpValueData = NULL;

[Alexandre Julliard]

Alistair Leslie-Hughes  writes:
> @@ -282,8 +282,12 @@ BOOL ModifyValue(HWND hwnd, HKEY hKeyRoot, LPCWSTR keyPath, LPCWSTR valueName)
>              else error_code_messagebox(hwnd, IDS_SET_VALUE_FAILED);
>          }
>      } else if ( type == REG_DWORD ) {
> -
>    WCHAR buffer[256];
>    static const WCHAR x[] = {'%','x',0};
> -
>    wsprintfW(stringValueData, x, *((DWORD*)stringValueData));
> -
>    DWORD value = *((DWORD*)stringValueData);
> -
>    heap_free(stringValueData);
> -
>    stringValueData = buffer;

This can't work, it needs to be allocated on the heap.