Guard against invalid string values of length 1 in wxRegKey
It is not really clear if it can happen, but avoid integer underflow in case it somehow does and just discard the single byte which can't represent a valid UTF-16 character anyhow. See #16719.
This commit is contained in:
committed by
Vadim Zeitlin
parent
142edf8b78
commit
d00fef689f
@@ -1023,7 +1023,9 @@ bool wxRegKey::QueryValue(const wxString& szValue,
|
||||
return false;
|
||||
}
|
||||
|
||||
if ( !dwSize )
|
||||
// We need length in characters, not bytes.
|
||||
DWORD chars = dwSize / sizeof(wxChar);
|
||||
if ( !chars )
|
||||
{
|
||||
// must treat this case specially as GetWriteBuf() doesn't like
|
||||
// being called with 0 size
|
||||
@@ -1033,9 +1035,6 @@ bool wxRegKey::QueryValue(const wxString& szValue,
|
||||
{
|
||||
// extra scope for wxStringBufferLength
|
||||
{
|
||||
// We need length in characters, not bytes.
|
||||
DWORD chars = dwSize / sizeof(wxChar);
|
||||
|
||||
wxStringBufferLength strBuf(strValue, chars);
|
||||
m_dwLastError = RegQueryValueEx((HKEY) m_hKey,
|
||||
RegValueStr(szValue),
|
||||
|
||||
Reference in New Issue
Block a user