5 ms·
`RegQueryValueExW`'s last parameter is in and out, so that `length` is set to the actual written length after the call. It might cause an OOB write though, wit
by seritools 5y ago
`RegQueryValueExW`'s last parameter is in and out, so that `length` is set to the actual written length after the call.
It might cause an OOB write though, with a data race on the registry key (if the key's value happens to grow in length by a char or two between the calls, time of check time of use yada yada).
- 323 5y ago> It might cause an OOB write though No, because `RegQueryValueExW` will return ERROR_MORE_DATA and the code bails out on error (also leaking the memory).
- malft 5y ago'by a char or two', they said.
- seritools 5y ago1. first call to `RegQueryValueExW` returns a value length of 10 2. length is set to 12 3. external change causes the value to now be 12 4. second call to ``RegQueryValueExW` succeeds, as 12 <= 12, no ERROR_MORE_DATA here; length stays 12 5. length + 1 and length + 2 are now OOB