Re: [PATCH v2 4/8] registry: Fix wrong truncation of Unicode.Length

[Tu Dinh <ngoc-tu.dinh@xxxxxxxxxx>]

On 17/08/2026 14:41, Owen Smith wrote:
> Assisted-by: ClaudeCode:claude-opus-4.8
> Signed-off-by: Owen Smith <owen.smith@xxxxxxxxxx>
> ---
>   src/common/registry.c | 18 +++++++++++++++---
>   1 file changed, 15 insertions(+), 3 deletions(-)
> 
> diff --git a/src/common/registry.c b/src/common/registry.c
> index 1f7a73c..f22a881 100644
> --- a/src/common/registry.c
> +++ b/src/common/registry.c
> @@ -1460,20 +1460,26 @@ RegistryAnsiToSz(
>       if (Partial == NULL)
>           goto fail1;
>   
> +    status = STATUS_BUFFER_OVERFLOW;
> +    if (Length * sizeof(WCHAR) > 0xFFFF) // MAX_USHORT
> +        goto fail2;
> +

I think this check should be moved before calling __RegistryAllocate. 
Also, this can use MAXUSHORT instead of 0xFFFF.

>       Partial->TitleIndex = 0;
>       Partial->Type = REG_SZ;
>       Partial->DataLength = Length * sizeof (WCHAR);
>   
> -    Unicode.MaximumLength = (UCHAR)Partial->DataLength;
> +    Unicode.MaximumLength = (USHORT)Partial->DataLength;
>       Unicode.Buffer = (PWCHAR)Partial->Data;
>       Unicode.Length = 0;
>   
>       status = RtlAnsiStringToUnicodeString(&Unicode, Ansi, FALSE);
>       if (!NT_SUCCESS(status))
> -        goto fail2;
> +        goto fail3;
>   
>       return Partial;
>   
> +fail3:
> +
>   fail2:
>       __RegistryFree(Partial);
>   
> @@ -1503,6 +1509,10 @@ RegistryAnsiToMultiSz(
>       if (Partial == NULL)
>           goto fail1;
>   
> +    status = STATUS_BUFFER_OVERFLOW;
> +    if (Length * sizeof(WCHAR) > 0xFFFF) // MAX_USHORT
> +        goto fail2;
> +
>       Partial->TitleIndex = 0;
>       Partial->Type = REG_MULTI_SZ;
>       Partial->DataLength = Length * sizeof (WCHAR);
> @@ -1514,7 +1524,7 @@ RegistryAnsiToMultiSz(
>       for (Index = 0; Ansi[Index].Buffer != NULL; Index++) {
>           status = RtlAnsiStringToUnicodeString(&Unicode, &Ansi[Index], 
> FALSE);
>           if (!NT_SUCCESS(status))
> -            goto fail2;
> +            goto fail3;
>   
>           Length = Unicode.Length / sizeof (WCHAR);
>   
> @@ -1527,6 +1537,8 @@ RegistryAnsiToMultiSz(
>   
>       return Partial;
>   
> +fail3:
> +
>   fail2:
>       __RegistryFree(Partial);
>   



--
Ngoc Tu Dinh | Vates XCP-ng Developer

XCP-ng & Xen Orchestra - Vates solutions

web: https://vates.tech