https://git.reactos.org/?p=reactos.git;a=commitdiff;h=97a23a5f3d6994730c312…
commit 97a23a5f3d6994730c3121ff57d76f158e4e10c5
Author: Mark Jansen <mark.jansen(a)reactos.org>
AuthorDate: Sat Apr 3 01:54:57 2021 +0200
Commit: Mark Jansen <mark.jansen(a)reactos.org>
CommitDate: Sat Apr 3 01:54:57 2021 +0200
[SERVICES] Fix booting with DPH enabled
RegSetValueExW tries to read one extra character after the buffer,
to see if a REG_SZ is null terminated
---
base/system/services/controlset.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/base/system/services/controlset.c b/base/system/services/controlset.c
index e9ac8ddc7e2..1eb0facd545 100644
--- a/base/system/services/controlset.c
+++ b/base/system/services/controlset.c
@@ -174,9 +174,10 @@ ScmCopyTree(
return ERROR_NOT_ENOUGH_MEMORY;
}
+ /* RegSetValueExW tries to read behind the maximum length, so give it space for that */
lpDataBuffer = HeapAlloc(GetProcessHeap(),
- 0,
- dwMaxValueLength);
+ HEAP_ZERO_MEMORY,
+ dwMaxValueLength + sizeof(WCHAR));
if (lpDataBuffer == NULL)
{
DPRINT1("Buffer allocation failed\n");