\nEven though a value is stored in the registry as REG_SZ,\nthis doesn’t mean that the value actually ends with a proper\nnull terminator. At the bottom, the registry is just a\nhierarchically-organized name\/value database.\n<\/p>\n
\nAnd you can lie and get away with it.\n<\/p>\n
\nLots of people lie about their registry data.\nYou’ll find lots of things that should be REG_DWORD\nstored as a four-byte REG_BINARY.\n(This is in part a holdover from Windows 95’s\nregistry, which didn’t support REG_DWORD.)\n<\/p>\n
\nOne of the most insidious lies is to lie about the length of\na string you’re writing to the registry.\nConsider the following program:\n<\/p>\n
\n#include <windows.h>\n#include <stdio.h>\nint __cdecl main(int argc, char **argv)\n{\n RegSetValueExW(HKEY_CURRENT_USER, L\"Scratch\",\n 0, REG_SZ, (BYTE*)L\"12\", 2);\n DWORD cb = 0;\n RegQueryValueExW(HKEY_CURRENT_USER, L\"Scratch\",\n NULL, NULL, NULL, &cb);\n printf(\"Size is %d bytes\\n\", cb);\n WCHAR sz[2];\n sz[0] = 0xFFFF;\n sz[1] = 0xFFFF;\n cb = sizeof(sz[0]);\n DWORD dwRc = RegQueryValueExW(HKEY_CURRENT_USER, L\"Scratch\",\n NULL, NULL, (BYTE*)sz, &cb);\n printf(\"RegQueryValueExW requesting %d bytes => %d\\n\",\n sizeof(sz), dwRc);\n printf(\"%d bytes required\\n\", cb);\n if (dwRc == ERROR_SUCCESS) {\n printf(\"sz[0] = %d\\n\", sz[0]);\n printf(\"sz[1] = %d\\n\", sz[1]);\n }\n RegDeleteValueW(HKEY_CURRENT_USER, L\"Scratch\");\n return 0;\n}\n<\/pre>\n\nIf you run this program, you get this:\n<\/p>\n
\nSize is 2 bytes\nRegQueryValueExW requesting 4 bytes => 0\n2 bytes required\nsz[0] = 49\nsz[1] = 65535\n<\/pre>\n\nWhat happened?\n<\/p>\n
\nFirst, observe that the call to RegSetValueExW lies about the length\nof the string, claiming that it is two bytes long when in fact\nit is six! (Two WCHARs plus a terminator.)\n<\/p>\n
\nThe registry dutifully records this lie and reports it back\nto subsequent callers.\n<\/p>\n
\nThe first call to RegQueryValueExW asks how big the string is,\nand the registry reports the value 2, since that’s the value it\nwas given when the value was originally stored.\n<\/p>\n
\nTo show that there really is no null terminator, we ask the\nregistry to read those two bytes of data into our buffer,\npre-filling the buffer with sentinel values so we can see\nwhat got updated and what didn’t.\n<\/p>\n
\nLo and behold, the values were read from the registry and\nonly two bytes were read. sz[0] contains the character ‘1’,\nand sz[1] remains uninitialized.\n<\/p>\n
\nThis has security implications<\/strong>.\n<\/p>\n\nIf your program assumes that strings in the registry are always\nnull-terminated, then you can be tricked into a buffer overflow\nif you happen across a non-null-terminated string.\n(For example, if you use strcpy<\/code> to copy it around.)\n<\/p>\n