On Mon, Jan 13, 2014 at 04:53:25PM +0100, Hilko Bengen wrote:
 ---
  lib/value.c | 14 +++++++-------
  1 file changed, 7 insertions(+), 7 deletions(-)
 
 diff --git a/lib/value.c b/lib/value.c
 index 65404d7..7b2e9d3 100644
 --- a/lib/value.c
 +++ b/lib/value.c
 @@ -207,14 +207,14 @@ hivex_value_key (hive_h *h, hive_value_h value)
    struct ntreg_vk_record *vk =
      (struct ntreg_vk_record *) ((char *) h->addr + value);
  
 -  /* AFAIK the key is always plain ASCII, so no conversion to UTF-8 is
 -   * necessary.  However we do need to nul-terminate the string.
 -   */
 -  errno = 0;
 -  size_t len = hivex_value_key_len (h, value);
 -  if (len == 0 && errno != 0)
 -    return NULL;
    size_t flags = le16toh (vk->flags);
 +  size_t len = le16toh (vk->name_len);
 +
 +  size_t seg_len = block_len (h, value, NULL);
 +  if (sizeof (struct ntreg_vk_record) + len - 1 > seg_len) {
 +    SET_ERRNO (EFAULT, "key length is too long (%zu, %zu)", len, seg_len);
 +    return 0; 
It's be nicer if this ^^ was return NULL rather than 0 (although of
course the effect is the same).
Anyhow, ACK.
Rich.
-- 
Richard Jones, Virtualization Group, Red Hat 
http://people.redhat.com/~rjones
virt-top is 'top' for virtual machines.  Tiny program with many
powerful monitoring features, net stats, disk stats, logging, etc.
http://people.redhat.com/~rjones/virt-top