Method Advapi32Util.registryGetValues calls Windows API function RegEnumValue to enumerate all data under a specified key. This function has the following interesting description in chapter Remarks on MSDN:
"If the data has the REG_SZ, REG_MULTI_SZ or REG_EXPAND_SZ type, the string may not have been stored with the proper null-terminating characters. Therefore, even if the function returns ERROR_SUCCESS, the application should ensure that the string is properly terminated before using it; otherwise, it may overwrite a buffer. (Note that REG_MULTI_SZ strings should have two null-terminating characters.)"
Advapi32Util.registryGetValues does not terminate the returned string with null terminators. When it tries to identify the string content it searches for the next null-terminator and will read out-of-bounds of the buffer.
Correction proposal:
The following patch is one way to fix the error:
Class: com.sun.jna.platform.win32.Advapi32Util
1496 case WinNT.REG_SZ:
1497 case WinNT.REG_EXPAND_SZ: {
1498 // START PATCH
1499 // Insert a unicode null terminator at the end of the string, since
1500 // RegEnumValue might return non-null-terminated strings.
1501 final Memory stringData = new Memory(lpcbData.getValue() + 2);
1502 stringData.write(0, data, 0, lpcbData.getValue());
1503 stringData.setByte(lpcbData.getValue(), (byte) 0);
1504 stringData.setByte(lpcbData.getValue() + 1, (byte) 0);
1505 // END PATCH
1506 keyValues.put(nameString, stringData.getString(0, true));
1507 break;
1508 }
Method Advapi32Util.registryGetValues calls Windows API function RegEnumValue to enumerate all data under a specified key. This function has the following interesting description in chapter Remarks on MSDN:
"If the data has the REG_SZ, REG_MULTI_SZ or REG_EXPAND_SZ type, the string may not have been stored with the proper null-terminating characters. Therefore, even if the function returns ERROR_SUCCESS, the application should ensure that the string is properly terminated before using it; otherwise, it may overwrite a buffer. (Note that REG_MULTI_SZ strings should have two null-terminating characters.)"
Advapi32Util.registryGetValues does not terminate the returned string with null terminators. When it tries to identify the string content it searches for the next null-terminator and will read out-of-bounds of the buffer.
Correction proposal:
The following patch is one way to fix the error:
Class: com.sun.jna.platform.win32.Advapi32Util