Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Advapi32Lib.registryGetValues might crash the process #340

Closed
emusand opened this issue Jun 24, 2014 · 1 comment
Closed

Advapi32Lib.registryGetValues might crash the process #340

emusand opened this issue Jun 24, 2014 · 1 comment

Comments

@emusand
Copy link

emusand commented Jun 24, 2014

Method Advapi32Util.registryGetValues calls Windows API function RegEnumValue to enumerate all data under a specified key. This function has the following interesting description in chapter Remarks on MSDN:

"If the data has the REG_SZ, REG_MULTI_SZ or REG_EXPAND_SZ type, the string may not have been stored with the proper null-terminating characters. Therefore, even if the function returns ERROR_SUCCESS, the application should ensure that the string is properly terminated before using it; otherwise, it may overwrite a buffer. (Note that REG_MULTI_SZ strings should have two null-terminating characters.)"

Advapi32Util.registryGetValues does not terminate the returned string with null terminators. When it tries to identify the string content it searches for the next null-terminator and will read out-of-bounds of the buffer.

Correction proposal:
The following patch is one way to fix the error:

Class: com.sun.jna.platform.win32.Advapi32Util

1496            case WinNT.REG_SZ:
1497            case WinNT.REG_EXPAND_SZ: {
1498                // START PATCH
1499                // Insert a unicode null terminator at the end of the string, since
1500                // RegEnumValue might return non-null-terminated strings.
1501                final Memory stringData = new Memory(lpcbData.getValue() + 2);
1502                stringData.write(0, data, 0, lpcbData.getValue());
1503                stringData.setByte(lpcbData.getValue(), (byte) 0);
1504                stringData.setByte(lpcbData.getValue() + 1, (byte) 0);
1505                // END PATCH
1506                keyValues.put(nameString, stringData.getString(0, true));
1507                break;
1508            }
@dblock
Copy link
Member

dblock commented Jun 24, 2014

Could you please help us with making a PR with a new test that reproduces the problem (write some data) and this fix? Thanks.

matthiasblaesing added a commit to matthiasblaesing/jna that referenced this issue Mar 22, 2018
mstyura pushed a commit to mstyura/jna that referenced this issue Sep 9, 2024
Motivation:

A new netty release is out

Modifications:

Upgrade to latest netty release

Result:

Use latest release as dependency
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

2 participants