From 957f3c5b50d83f0e2f81ef70da7e6f1906807c7b Mon Sep 17 00:00:00 2001
From: Vadim Zeitlin <vadim@wxwidgets.org>
Date: Sat, 27 Dec 2014 14:24:58 +0000
Subject: [PATCH] Fix reading of not NUL-terminated strings using wxRegKey.

Even though this is typically the case, some strings in Windows registry are
not NUL-terminated, deal with them correctly by using the explicit length.

Closes #16719.

git-svn-id: https://svn.wxwidgets.org/svn/wx/wxWidgets/trunk@78327 c3d73ce0-8a6f-49c7-b76d-6d57e0e08775
---
 docs/changes.txt     |  1 +
 src/msw/registry.cpp | 27 +++++++++++++++++++++------
 2 files changed, 22 insertions(+), 6 deletions(-)

diff --git a/docs/changes.txt b/docs/changes.txt
index ce8a659df0..3ea00ee7e9 100644
--- a/docs/changes.txt
+++ b/docs/changes.txt
@@ -126,6 +126,7 @@ wxMSW:
 - Fix wxMenuEvent::GetMenu() for wxEVT_MENU_{OPEN,CLOSE} in MDI frames.
 - Fix updating wxSpinCtrlDouble tooltip text (Laurent Poujoulat).
 - Fix appearance of checked disabled wxToolBar tools with custom images.
+- Fix reading of not NUL-terminated strings using wxRegKey (Steffen Olszewski).
 
 wxOSX/Cocoa:
 
diff --git a/src/msw/registry.cpp b/src/msw/registry.cpp
index 86a7e3a776..48bca6e922 100644
--- a/src/msw/registry.cpp
+++ b/src/msw/registry.cpp
@@ -995,12 +995,27 @@ bool wxRegKey::QueryValue(const wxString& szValue,
             }
             else
             {
-                m_dwLastError = RegQueryValueEx((HKEY) m_hKey,
-                                                RegValueStr(szValue),
-                                                RESERVED,
-                                                &dwType,
-                                                (RegString)(wxChar*)wxStringBuffer(strValue, dwSize),
-                                                &dwSize);
+                // extra scope for wxStringBufferLength
+                {
+                    // We need length in characters, not bytes.
+                    DWORD chars = dwSize / sizeof(wxChar);
+
+                    wxStringBufferLength strBuf(strValue, chars);
+                    m_dwLastError = RegQueryValueEx((HKEY) m_hKey,
+                                                    RegValueStr(szValue),
+                                                    RESERVED,
+                                                    &dwType,
+                                                    (RegString)(wxChar*)strBuf,
+                                                    &dwSize);
+
+                    // The returned string may or not be NUL-terminated,
+                    // exclude the trailing NUL if it's there (which is
+                    // typically the case but is not guaranteed to always be).
+                    if ( strBuf[chars - 1] == '\0' )
+                        chars--;
+
+                    strBuf.SetLength(chars);
+                }
 
                 // expand the var expansions in the string unless disabled
 #ifndef __WXWINCE__