---
lib/value.c | 26 +++++++++++++++++++++++---
1 file changed, 23 insertions(+), 3 deletions(-)
diff --git a/lib/value.c b/lib/value.c
index db6396f..c4e21ec 100644
--- a/lib/value.c
+++ b/lib/value.c
@@ -462,7 +462,27 @@ hivex_value_string (hive_h *h, hive_value_h value)
return ret;
}
-/*
http://blogs.msdn.com/oldnewthing/archive/2009/10/08/9904646.aspx */
+/* Even though
+ *
http://msdn.microsoft.com/en-us/library/windows/desktop/ms724884.aspx
+ * and
+ *
http://blogs.msdn.com/oldnewthing/archive/2009/10/08/9904646.aspx
+ * claim that it is not possible to store empty strings in MULTI_SZ
+ * string lists, such lists are used by Windows itself:
+ *
+ * The MoveFileEx function can schedule files to be renamed (or
+ * removed) at restart time by storing pairs of filenames in the
+ * HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\PendingFileRenameOperations
+ * value.
+ *
+ * The documentation for MoveFileEx
+ * (
http://msdn.microsoft.com/en-us/library/windows/desktop/aa365240)
+ * states that "[i]f dwFlags specifies MOVEFILE_DELAY_UNTIL_REBOOT,
+ * and lpNewFileName is NULL, MoveFileEx registers the
+ * lpExistingFileName file to be deleted when the system restarts."
+ *
+ * For scheduled removals, the second file name of any pair stored in
+ * PendingFileRenameOperations is an empty string.
+ */
char **
hivex_value_multiple_strings (hive_h *h, hive_value_h value)
{
@@ -490,8 +510,8 @@ hivex_value_multiple_strings (hive_h *h, hive_value_h value)
char *p = data;
size_t plen;
- while (p < data + len &&
- (plen = _hivex_utf16_string_len_in_bytes_max (p, data + len - p)) > 0) {
+ while (p < data + len) {
+ plen = _hivex_utf16_string_len_in_bytes_max (p, data + len - p);
nr_strings++;
char **ret2 = realloc (ret, (1 + nr_strings) * sizeof (char *));
if (ret2 == NULL) {
--
1.8.5.2