[PATCH 1/3] reg: Allow the 'reg_data' pointer to be NULL

[Hugh McMaster]

Signed-off-by: Hugh McMaster 
---
 programs/reg/add.c | 52 ++++++++++++++++++++++++++--------------------
 1 file changed, 29 insertions(+), 23 deletions(-)

diff --git a/programs/reg/add.c b/programs/reg/add.c
index 9aaa3fc1acc..cb26c232de3 100644
--- a/programs/reg/add.c
+++ b/programs/reg/add.c
@@ -48,10 +48,10 @@ static inline BYTE hexchar_to_byte(WCHAR ch)
         return -1;
 }

-static BYTE *get_regdata(const WCHAR *data, DWORD reg_type, WCHAR separator, DWORD *size_bytes)
+static BOOL get_regdata(const WCHAR *data, DWORD reg_type, WCHAR separator,
+                        BYTE **data_bytes, DWORD *size_bytes)
 {
     static const WCHAR empty;
-    LPBYTE out_data = NULL;

*size_bytes = 0;

@@ -64,8 +64,8 @@ static BYTE *get_regdata(const WCHAR *data, DWORD reg_type, WCHAR separator, DWO
         case REG_EXPAND_SZ:
         {
             *size_bytes = (lstrlenW(data) + 1) * sizeof(WCHAR);
-            out_data = malloc(*size_bytes);
-            lstrcpyW((LPWSTR)out_data,data);
+            *data_bytes = malloc(*size_bytes);
+            lstrcpyW((WCHAR *)*data_bytes, data);
             break;
         }
         case REG_DWORD:
@@ -77,41 +77,46 @@ static BYTE *get_regdata(const WCHAR *data, DWORD reg_type, WCHAR separator, DWO
             val = wcstoul(data, &rest, (towlower(data[1]) == 'x') ? 16 : 10);
             if (*rest || data[0] == '-' || (val == ~0u && errno == ERANGE)) {
                 output_message(STRING_MISSING_INTEGER);
-                break;
+                return FALSE;
             }
             *size_bytes = sizeof(DWORD);
-            out_data = malloc(*size_bytes);
-            ((LPDWORD)out_data)[0] = val;
+            *data_bytes = malloc(*size_bytes);
+            *(DWORD *)*data_bytes = val;
             break;
         }
         case REG_BINARY:
         {
-            BYTE hex0, hex1;
+            BYTE hex0, hex1, *ptr;
             int i = 0, destByteIndex = 0, datalen = lstrlenW(data);
+
             *size_bytes = ((datalen + datalen % 2) / 2) * sizeof(BYTE);
-            out_data = malloc(*size_bytes);
-            if(datalen % 2)
+            *data_bytes = malloc(*size_bytes);
+
+            if (datalen % 2)
             {
                 hex1 = hexchar_to_byte(data[i++]);
-                if(hex1 == 0xFF)
+                if (hex1 == 0xFF)
                     goto no_hex_data;
-                out_data[destByteIndex++] = hex1;
+                *data_bytes[destByteIndex++] = hex1;
             }
-            for(;i + 1 < datalen;i += 2)
+
+            ptr = *data_bytes;
+
+            for (; i + 1 < datalen; i += 2)
             {
                 hex0 = hexchar_to_byte(data[i]);
                 hex1 = hexchar_to_byte(data[i + 1]);
-                if(hex0 == 0xFF || hex1 == 0xFF)
+                if (hex0 == 0xFF || hex1 == 0xFF)
                     goto no_hex_data;
-                out_data[destByteIndex++] = (hex0 << 4) | hex1;
+                ptr[destByteIndex++] = (hex0 << 4) | hex1;
             }
             break;
+
             no_hex_data:
-            /* cleanup, print error */
-            free(out_data);
+            free(*data_bytes);
+            *data_bytes = NULL;
             output_message(STRING_MISSING_HEXDATA);
-            out_data = NULL;
-            break;
+            return FALSE;
         }
         case REG_MULTI_SZ:
         {
@@ -134,20 +139,21 @@ static BYTE *get_regdata(const WCHAR *data, DWORD reg_type, WCHAR separator, DWO
                 {
                     free(buffer);
                     output_message(STRING_INVALID_STRING);
-                    return NULL;
+                    return FALSE;
                 }
             }
             buffer[destindex] = 0;
             if (destindex && buffer[destindex - 1])
                 buffer[++destindex] = 0;
             *size_bytes = (destindex + 1) * sizeof(WCHAR);
-            return (BYTE *)buffer;
+            *data_bytes = (BYTE *)buffer;
+            break;
         }
         default:
             output_message(STRING_UNHANDLED_TYPE, reg_type, data);
     }

-    return out_data;
+    return TRUE;
 }

static int run_add(HKEY root, WCHAR *path, WCHAR *value_name, BOOL value_empty,
@@ -194,7 +200,7 @@ static int run_add(HKEY root, WCHAR *path, WCHAR *value_name, BOOL value_empty,
          return 1;
     }

-    if (!(reg_data = get_regdata(data, data_type, separator, &data_size)))
+    if (!get_regdata(data, data_type, separator, &reg_data, &data_size))
     {
         RegCloseKey(hkey);
         return 1;

[PATCH 2/3] reg: Avoid allocating zero bytes of memory when handling REG_BINARY data

[Hugh McMaster]

Signed-off-by: Hugh McMaster 
---
 programs/reg/add.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/programs/reg/add.c b/programs/reg/add.c
index cb26c232de3..0236dfb4742 100644
--- a/programs/reg/add.c
+++ b/programs/reg/add.c
@@ -89,6 +89,8 @@ static BOOL get_regdata(const WCHAR *data, DWORD reg_type, WCHAR separator,
             BYTE hex0, hex1, *ptr;
             int i = 0, destByteIndex = 0, datalen = lstrlenW(data);

+            if (!datalen) return TRUE;
+
             *size_bytes = ((datalen + datalen % 2) / 2) * sizeof(BYTE);
             *data_bytes = malloc(*size_bytes);

[PATCH 3/3] reg: Prevent buffer over-read when querying REG_NONE values with no data

[Hugh McMaster]

Signed-off-by: Hugh McMaster 
---
 programs/reg/query.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/programs/reg/query.c b/programs/reg/query.c
index 7e42719faf9..4886fb84bc1 100644
--- a/programs/reg/query.c
+++ b/programs/reg/query.c
@@ -50,7 +50,15 @@ static WCHAR *reg_data_to_wchar(DWORD type, const BYTE *src, DWORD size_bytes)
             WCHAR *ptr;

buffer = malloc((size_bytes * 2 + 1) * sizeof(WCHAR));
+
+            if (!size_bytes)
+            {
+                *buffer = 0;
+                break;
+            }
+
             ptr = buffer;
+
             for (i = 0; i < size_bytes; i++)
                 ptr += swprintf(ptr, 3, L"%02X", src[i]);
             break;