You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Method Advapi32Util.registryGetValues calls Windows API function RegEnumValue to enumerate all data under a specified key. This function has the following interesting description in chapter Remarks on MSDN:
"If the data has the REG_SZ, REG_MULTI_SZ or REG_EXPAND_SZ type, the string may not have been stored with the proper null-terminating characters. Therefore, even if the function returns ERROR_SUCCESS, the application should ensure that the string is properly terminated before using it; otherwise, it may overwrite a buffer. (Note that REG_MULTI_SZ strings should have two null-terminating characters.)"
Advapi32Util.registryGetValues does not terminate the returned string with null terminators. When it tries to identify the string content it searches for the next null-terminator and will read out-of-bounds of the buffer.
Correction proposal:
The following patch is one way to fix the error:
Class: com.sun.jna.platform.win32.Advapi32Util
1496caseWinNT.REG_SZ:
1497caseWinNT.REG_EXPAND_SZ: {
1498// START PATCH1499// Insert a unicode null terminator at the end of the string, since1500// RegEnumValue might return non-null-terminated strings.1501finalMemorystringData = newMemory(lpcbData.getValue() + 2);
1502stringData.write(0, data, 0, lpcbData.getValue());
1503stringData.setByte(lpcbData.getValue(), (byte) 0);
1504stringData.setByte(lpcbData.getValue() + 1, (byte) 0);
1505// END PATCH1506keyValues.put(nameString, stringData.getString(0, true));
1507break;
1508 }
The text was updated successfully, but these errors were encountered:
Method Advapi32Util.registryGetValues calls Windows API function RegEnumValue to enumerate all data under a specified key. This function has the following interesting description in chapter Remarks on MSDN:
"If the data has the REG_SZ, REG_MULTI_SZ or REG_EXPAND_SZ type, the string may not have been stored with the proper null-terminating characters. Therefore, even if the function returns ERROR_SUCCESS, the application should ensure that the string is properly terminated before using it; otherwise, it may overwrite a buffer. (Note that REG_MULTI_SZ strings should have two null-terminating characters.)"
Advapi32Util.registryGetValues does not terminate the returned string with null terminators. When it tries to identify the string content it searches for the next null-terminator and will read out-of-bounds of the buffer.
Correction proposal:
The following patch is one way to fix the error:
Class: com.sun.jna.platform.win32.Advapi32Util
The text was updated successfully, but these errors were encountered: