[PATCH v2 4/8] registry: Fix wrong truncation of Unicode.Length

[Owen Smith <owen.smith@xxxxxxxxxx>]

Assisted-by: ClaudeCode:claude-opus-4.8
Signed-off-by: Owen Smith <owen.smith@xxxxxxxxxx>
---
 src/common/registry.c | 18 +++++++++++++++---
 1 file changed, 15 insertions(+), 3 deletions(-)

diff --git a/src/common/registry.c b/src/common/registry.c
index 1f7a73c..f22a881 100644
--- a/src/common/registry.c
+++ b/src/common/registry.c
@@ -1460,20 +1460,26 @@ RegistryAnsiToSz(
     if (Partial == NULL)
         goto fail1;
 
+    status = STATUS_BUFFER_OVERFLOW;
+    if (Length * sizeof(WCHAR) > 0xFFFF) // MAX_USHORT
+        goto fail2;
+
     Partial->TitleIndex = 0;
     Partial->Type = REG_SZ;
     Partial->DataLength = Length * sizeof (WCHAR);
 
-    Unicode.MaximumLength = (UCHAR)Partial->DataLength;
+    Unicode.MaximumLength = (USHORT)Partial->DataLength;
     Unicode.Buffer = (PWCHAR)Partial->Data;
     Unicode.Length = 0;
 
     status = RtlAnsiStringToUnicodeString(&Unicode, Ansi, FALSE);
     if (!NT_SUCCESS(status))
-        goto fail2;
+        goto fail3;
 
     return Partial;
 
+fail3:
+
 fail2:
     __RegistryFree(Partial);
 
@@ -1503,6 +1509,10 @@ RegistryAnsiToMultiSz(
     if (Partial == NULL)
         goto fail1;
 
+    status = STATUS_BUFFER_OVERFLOW;
+    if (Length * sizeof(WCHAR) > 0xFFFF) // MAX_USHORT
+        goto fail2;
+
     Partial->TitleIndex = 0;
     Partial->Type = REG_MULTI_SZ;
     Partial->DataLength = Length * sizeof (WCHAR);
@@ -1514,7 +1524,7 @@ RegistryAnsiToMultiSz(
     for (Index = 0; Ansi[Index].Buffer != NULL; Index++) {
         status = RtlAnsiStringToUnicodeString(&Unicode, &Ansi[Index], FALSE);
         if (!NT_SUCCESS(status))
-            goto fail2;
+            goto fail3;
 
         Length = Unicode.Length / sizeof (WCHAR);
 
@@ -1527,6 +1537,8 @@ RegistryAnsiToMultiSz(
 
     return Partial;
 
+fail3:
+
 fail2:
     __RegistryFree(Partial);
 
-- 
2.51.2.windows.1