Re: [PATCH] registry: Fix wrong truncation of Unicode.Length

[Tu Dinh <ngoc-tu.dinh@xxxxxxxxxx>]

On 25/08/2026 23:02, Tu Dinh wrote:
> Assisted-by: ClaudeCode:claude-opus-4.8
> Signed-off-by: Owen Smith <owen.smith@xxxxxxxxxx>
> 
> Ported from XenBus.
> 
> Signed-off-by: Tu Dinh <ngoc-tu.dinh@xxxxxxxxxx>

Hello,

Looks like this patch has not been applied to xenvkbd.

> ---
>   src/xenvkbd/registry.c | 27 ++++++++++++++++++++-------
>   1 file changed, 20 insertions(+), 7 deletions(-)
> 
> diff --git a/src/xenvkbd/registry.c b/src/xenvkbd/registry.c
> index 8f84818..e498497 100644
> --- a/src/xenvkbd/registry.c
> +++ b/src/xenvkbd/registry.c
> @@ -1305,30 +1305,37 @@ RegistryAnsiToSz(
>       NTSTATUS                        status;
>   
>       Length = Ansi->Length + 1;
> +
> +    status = STATUS_BUFFER_OVERFLOW;
> +    if (Length * sizeof(WCHAR) > MAXUSHORT)
> +        goto fail1;
> +
>       Partial = 
> __RegistryAllocate(FIELD_OFFSET(KEY_VALUE_PARTIAL_INFORMATION, Data) +
>                                    Length * sizeof (WCHAR));
>   
>       status = STATUS_NO_MEMORY;
>       if (Partial == NULL)
> -        goto fail1;
> +        goto fail2;
>   
>       Partial->TitleIndex = 0;
>       Partial->Type = REG_SZ;
>       Partial->DataLength = Length * sizeof (WCHAR);
>   
> -    Unicode.MaximumLength = (UCHAR)Partial->DataLength;
> +    Unicode.MaximumLength = (USHORT)Partial->DataLength;
>       Unicode.Buffer = (PWCHAR)Partial->Data;
>       Unicode.Length = 0;
>   
>       status = RtlAnsiStringToUnicodeString(&Unicode, Ansi, FALSE);
>       if (!NT_SUCCESS(status))
> -        goto fail2;
> +        goto fail3;
>   
>       return Partial;
>   
> -fail2:
> +fail3:
>       __RegistryFree(Partial);
>   
> +fail2:
> +
>   fail1:
>       return NULL;
>   }
> @@ -1348,12 +1355,16 @@ RegistryAnsiToMultiSz(
>       for (Index = 0; Ansi[Index].Buffer != NULL; Index++)
>           Length += Ansi[Index].Length + 1;
>   
> +    status = STATUS_BUFFER_OVERFLOW;
> +    if (Length * sizeof(WCHAR) > MAXUSHORT)
> +        goto fail1;
> +
>       Partial = 
> __RegistryAllocate(FIELD_OFFSET(KEY_VALUE_PARTIAL_INFORMATION, Data) +
>                                  Length * sizeof (WCHAR));
>   
>       status = STATUS_NO_MEMORY;
>       if (Partial == NULL)
> -        goto fail1;
> +        goto fail2;
>   
>       Partial->TitleIndex = 0;
>       Partial->Type = REG_MULTI_SZ;
> @@ -1366,7 +1377,7 @@ RegistryAnsiToMultiSz(
>       for (Index = 0; Ansi[Index].Buffer != NULL; Index++) {
>           status = RtlAnsiStringToUnicodeString(&Unicode, &Ansi[Index], 
> FALSE);
>           if (!NT_SUCCESS(status))
> -            goto fail2;
> +            goto fail3;
>   
>           Length = Unicode.Length / sizeof (WCHAR);
>   
> @@ -1379,9 +1390,11 @@ RegistryAnsiToMultiSz(
>   
>       return Partial;
>   
> -fail2:
> +fail3:
>       __RegistryFree(Partial);
>   
> +fail2:
> +
>   fail1:
>       return NULL;
>   }



--
Ngoc Tu Dinh | Vates XCP-ng Developer

XCP-ng & Xen Orchestra - Vates solutions

web: https://vates.tech