Re: [PATCH] registry: Fix wrong truncation of Unicode.Length

[Owen Smith <owen.smith@xxxxxxxxxx>]

This set of patches all
Reviewed-by: Owen Smith <owen.smith@xxxxxxxxxx>

________________________________________
From: Tu Dinh <ngoc-tu.dinh@xxxxxxxxxx>
Sent: 25 August 2026 10:02 PM
To: win-pv-devel@xxxxxxxxxxxxxxxxxxxx
Cc: Tu Dinh; Owen Smith
Subject: [PATCH] registry: Fix wrong truncation of Unicode.Length

Assisted-by: ClaudeCode:claude-opus-4.8
Signed-off-by: Owen Smith <owen.smith@xxxxxxxxxx>

Ported from XenBus.

Signed-off-by: Tu Dinh <ngoc-tu.dinh@xxxxxxxxxx>
---
 src/xenvkbd/registry.c | 27 ++++++++++++++++++++-------
 1 file changed, 20 insertions(+), 7 deletions(-)

diff --git a/src/xenvkbd/registry.c b/src/xenvkbd/registry.c
index 8f84818..e498497 100644
--- a/src/xenvkbd/registry.c
+++ b/src/xenvkbd/registry.c
@@ -1305,30 +1305,37 @@ RegistryAnsiToSz(
     NTSTATUS                        status;

     Length = Ansi->Length + 1;
+
+    status = STATUS_BUFFER_OVERFLOW;
+    if (Length * sizeof(WCHAR) > MAXUSHORT)
+        goto fail1;
+
     Partial = __RegistryAllocate(FIELD_OFFSET(KEY_VALUE_PARTIAL_INFORMATION, 
Data) +
                                  Length * sizeof (WCHAR));

     status = STATUS_NO_MEMORY;
     if (Partial == NULL)
-        goto fail1;
+        goto fail2;

     Partial->TitleIndex = 0;
     Partial->Type = REG_SZ;
     Partial->DataLength = Length * sizeof (WCHAR);

-    Unicode.MaximumLength = (UCHAR)Partial->DataLength;
+    Unicode.MaximumLength = (USHORT)Partial->DataLength;
     Unicode.Buffer = (PWCHAR)Partial->Data;
     Unicode.Length = 0;

     status = RtlAnsiStringToUnicodeString(&Unicode, Ansi, FALSE);
     if (!NT_SUCCESS(status))
-        goto fail2;
+        goto fail3;

     return Partial;

-fail2:
+fail3:
     __RegistryFree(Partial);

+fail2:
+
 fail1:
     return NULL;
 }
@@ -1348,12 +1355,16 @@ RegistryAnsiToMultiSz(
     for (Index = 0; Ansi[Index].Buffer != NULL; Index++)
         Length += Ansi[Index].Length + 1;

+    status = STATUS_BUFFER_OVERFLOW;
+    if (Length * sizeof(WCHAR) > MAXUSHORT)
+        goto fail1;
+
     Partial = __RegistryAllocate(FIELD_OFFSET(KEY_VALUE_PARTIAL_INFORMATION, 
Data) +
                                Length * sizeof (WCHAR));

     status = STATUS_NO_MEMORY;
     if (Partial == NULL)
-        goto fail1;
+        goto fail2;

     Partial->TitleIndex = 0;
     Partial->Type = REG_MULTI_SZ;
@@ -1366,7 +1377,7 @@ RegistryAnsiToMultiSz(
     for (Index = 0; Ansi[Index].Buffer != NULL; Index++) {
         status = RtlAnsiStringToUnicodeString(&Unicode, &Ansi[Index], FALSE);
         if (!NT_SUCCESS(status))
-            goto fail2;
+            goto fail3;

         Length = Unicode.Length / sizeof (WCHAR);

@@ -1379,9 +1390,11 @@ RegistryAnsiToMultiSz(

     return Partial;

-fail2:
+fail3:
     __RegistryFree(Partial);

+fail2:
+
 fail1:
     return NULL;
 }
--
2.55.0.windows.3



--
Ngoc Tu Dinh | Vates XCP-ng Developer

XCP-ng & Xen Orchestra - Vates solutions

web: https://vates.tech