Bug 961 – std.windows.registry stack corruption

Status
RESOLVED
Resolution
FIXED
Severity
normal
Priority
P2
Component
phobos
Product
D
Version
D2
Platform
x86
OS
Windows
Creation time
2007-02-14T00:23:00Z
Last change time
2015-06-09T05:14:51Z
Assigned to
bugzilla
Creator
technocrat7

Attachments

IDFilenameSummaryContent-TypeSize
101registry.patchJay Jacobson's proposed fixtext/plain2231

Comments

Comment #0 by technocrat7 — 2007-02-14T00:23:03Z
Jay Jacobson created a patch that seems to fix some bugs in std.windows.registry. Without the patch, my registry programs didn't work quite right, but after applying his patch, my programs worked fine. <Quote> The first was on line 691 and had to do with setting the cbData value to be the size of a DWORD 8. This lead to the odd problem pointed at in the previous post. This caused all string registry values with a size less than 8 to become corrupted because the fall-through test of "too small a buffer" was skipped. In the case of a string, you can't know what the size is in advance without first calling the function to obtain the correct size to allocate. The subsequent call then works (the fall-through test). Unfortunately, the one liner fix caused the DWORD registry entries to not be read correctly which lead to the addition of the case statement to appropriately set the "data" variable ptr (might be a better way to do this). Additionally, I found that the EXPAND_SZ method was not stripping a trailing NULL from the ExpandEnvironmentStringsA call. </Quote>
Comment #1 by technocrat7 — 2007-02-14T00:24:24Z
Created attachment 101 Jay Jacobson's proposed fix
Comment #2 by bugzilla — 2007-08-12T14:08:18Z
I carefully read the code in Reg_QueryValue_(), and cannot see what the problem is. If the string length is less than 8, it is stored in u.qw, and 'data' points to it. The other problem with EXPAND_SZ noted will be fixed.
Comment #3 by bugzilla — 2007-08-12T14:33:41Z
Ah, I found the problem - for small strings, it's returning a pointer to a local stack variable, which will cause corruption upon function exit. Will fix.
Comment #4 by bugzilla — 2007-09-28T22:05:57Z
Fixed dmd 1.021 and 2.004