From: Bernhard Übelacker <bernhardu@vr-web.de>
Subject: [PATCH 5/8] dwrite: Call RegEnumValueW with value and val_count parameters.
Message-Id: <1435667886-6291-6-git-send-email-bernhardu@vr-web.de>
Date: Tue, 30 Jun 2015 14:38:03 +0200

Bug #38796
---
 dlls/dwrite/font.c | 28 +++++++++++++++++++++++-----
 1 file changed, 23 insertions(+), 5 deletions(-)

diff --git a/dlls/dwrite/font.c b/dlls/dwrite/font.c
index 2091867..3e25992 100644
--- a/dlls/dwrite/font.c
+++ b/dlls/dwrite/font.c
@@ -1845,8 +1845,8 @@ static ULONG WINAPI systemfontfileenumerator_Release(IDWriteFontFileEnumerator *
 static HRESULT WINAPI systemfontfileenumerator_GetCurrentFontFile(IDWriteFontFileEnumerator *iface, IDWriteFontFile **file)
 {
     struct system_fontfile_enumerator *enumerator = impl_from_IDWriteFontFileEnumerator(iface);
-    DWORD ret, type, count;
-    WCHAR *filename;
+    DWORD ret, type, val_count, count;
+    WCHAR *value, *filename;
     HRESULT hr;
 
     *file = NULL;
@@ -1854,14 +1854,20 @@ static HRESULT WINAPI systemfontfileenumerator_GetCurrentFontFile(IDWriteFontFil
     if (enumerator->index < 0)
         return E_FAIL;
 
-    if (RegEnumValueW(enumerator->hkey, enumerator->index, NULL, NULL, NULL, &type, NULL, &count))
+    ret = RegQueryInfoKeyW(enumerator->hkey, NULL, NULL, NULL, NULL, NULL, NULL, NULL, &val_count, &count, NULL, NULL);
+    if (ret != ERROR_SUCCESS)
         return E_FAIL;
 
+    val_count++;
+    if (!(value = heap_alloc( val_count * sizeof(value[0]) )))
+        return E_OUTOFMEMORY;
+
     if (!(filename = heap_alloc(count)))
         return E_OUTOFMEMORY;
 
-    ret = RegEnumValueW(enumerator->hkey, enumerator->index, NULL, NULL, NULL, &type, (BYTE*)filename, &count);
+    ret = RegEnumValueW(enumerator->hkey, enumerator->index, value, &val_count, NULL, &type, (BYTE*)filename, &count);
     if (ret) {
+        heap_free(value);
         heap_free(filename);
         return E_FAIL;
     }
@@ -1880,6 +1886,7 @@ static HRESULT WINAPI systemfontfileenumerator_GetCurrentFontFile(IDWriteFontFil
     else
         hr = IDWriteFactory2_CreateFontFileReference(enumerator->factory, filename, NULL, file);
 
+    heap_free(value);
     heap_free(filename);
     return hr;
 }
@@ -1887,14 +1894,24 @@ static HRESULT WINAPI systemfontfileenumerator_GetCurrentFontFile(IDWriteFontFil
 static HRESULT WINAPI systemfontfileenumerator_MoveNext(IDWriteFontFileEnumerator *iface, BOOL *current)
 {
     struct system_fontfile_enumerator *enumerator = impl_from_IDWriteFontFileEnumerator(iface);
+    DWORD ret, val_count;
+    WCHAR *value;
 
     *current = FALSE;
     enumerator->index++;
 
+    ret = RegQueryInfoKeyW(enumerator->hkey, NULL, NULL, NULL, NULL, NULL, NULL, NULL, &val_count, NULL, NULL, NULL);
+    if (ret != ERROR_SUCCESS)
+        return E_FAIL;
+
+    val_count++;
+    if (!(value = heap_alloc( val_count * sizeof(value[0]) )))
+        return E_OUTOFMEMORY;
+
     /* iterate until we find next string value */
     while (1) {
         DWORD type = 0, count;
-        if (RegEnumValueW(enumerator->hkey, enumerator->index, NULL, NULL, NULL, &type, NULL, &count))
+        if (RegEnumValueW(enumerator->hkey, enumerator->index, value, &val_count, NULL, &type, NULL, &count))
             break;
         if (type == REG_SZ) {
             *current = TRUE;
@@ -1904,6 +1921,7 @@ static HRESULT WINAPI systemfontfileenumerator_MoveNext(IDWriteFontFileEnumerato
     }
 
     TRACE("index = %d, current = %d\n", enumerator->index, *current);
+    heap_free(value);
     return S_OK;
 }
 

-- 
2.1.4