From c0bb728456f962bdd9f90c30c999835d795d33e8 Mon Sep 17 00:00:00 2001
From: Iain Patterson <me@iain.cx>
Date: Fri, 22 Jul 2016 12:05:44 +0100
Subject: [PATCH] Handle second parameter of unformat_double_null().

The length of the formatted buffer is supposed to be a count of
characters NOT including the trailing NULL.
---
 env.h        |  1 +
 registry.cpp | 44 ++++++++++++++++++++++++++------------------
 2 files changed, 27 insertions(+), 18 deletions(-)

diff --git a/env.h b/env.h
index a56456d..73bcedd 100644
--- a/env.h
+++ b/env.h
@@ -1,6 +1,7 @@
 #ifndef ENV_H
 #define ENV_H
 
+size_t environment_length(TCHAR *);
 TCHAR *copy_environment_block(TCHAR *);
 TCHAR *useful_environment(TCHAR *);
 TCHAR *expand_environment_string(TCHAR *);
diff --git a/registry.cpp b/registry.cpp
index 48783f1..4e432ab 100644
--- a/registry.cpp
+++ b/registry.cpp
@@ -441,32 +441,40 @@ int format_double_null(TCHAR *dn, unsigned long dnlen, TCHAR **formatted, unsign
   return 0;
 }
 
-/* Strip CR and replace LF with NULL. */
-int unformat_double_null(TCHAR *dn, unsigned long dnlen, TCHAR **unformatted, unsigned long *newlen) {
+/* Strip CR and replace LF with NULL.  */
+int unformat_double_null(TCHAR *formatted, unsigned long formattedlen, TCHAR **dn, unsigned long *newlen) {
   unsigned long i, j;
   *newlen = 0;
 
-  if (! dnlen) {
-    *unformatted = 0;
+  /* Don't count trailing NULLs. */
+  for (i = 0; i < formattedlen; i++) {
+    if (! formatted[i]) {
+      formattedlen = i;
+      break;
+    }
+  }
+
+  if (! formattedlen) {
+    *dn = 0;
     return 0;
   }
 
-  for (i = 0; i < dnlen; i++) if (dn[i] != _T('\r')) ++*newlen;
+  for (i = 0; i < formattedlen; i++) if (formatted[i] != _T('\r')) ++*newlen;
 
   /* Skip blank lines. */
-  for (i = 0; i < dnlen; i++) {
-    if (dn[i] == _T('\r') && dn[i + 1] == _T('\n')) {
+  for (i = 0; i < formattedlen; i++) {
+    if (formatted[i] == _T('\r') && formatted[i + 1] == _T('\n')) {
       /* This is the last CRLF. */
-      if (i >= dnlen - 2) break;
+      if (i >= formattedlen - 2) break;
 
       /*
         Strip at the start of the block or if the next characters are
         CRLF too.
       */
-      if (! i || (dn[i + 2] == _T('\r') && dn[i + 3] == _T('\n'))) {
-        for (j = i + 2; j < dnlen; j++) dn[j - 2] = dn[j];
-        dn[dnlen--] = _T('\0');
-        dn[dnlen--] = _T('\0');
+      if (! i || (formatted[i + 2] == _T('\r') && formatted[i + 3] == _T('\n'))) {
+        for (j = i + 2; j < formattedlen; j++) formatted[j - 2] = formatted[j];
+        formatted[formattedlen--] = _T('\0');
+        formatted[formattedlen--] = _T('\0');
         i--;
         --*newlen;
       }
@@ -476,13 +484,13 @@ int unformat_double_null(TCHAR *dn, unsigned long dnlen, TCHAR **unformatted, un
   /* Must end with two NULLs. */
   *newlen += 2;
 
-  *unformatted = (TCHAR *) HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, *newlen * sizeof(TCHAR));
-  if (! *unformatted) return 1;
+  *dn = (TCHAR *) HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, *newlen * sizeof(TCHAR));
+  if (! *dn) return 1;
 
-  for (i = 0, j = 0; i < dnlen; i++) {
-    if (dn[i] == _T('\r')) continue;
-    if (dn[i] == _T('\n')) (*unformatted)[j] = _T('\0');
-    else (*unformatted)[j] = dn[i];
+  for (i = 0, j = 0; i < formattedlen; i++) {
+    if (formatted[i] == _T('\r')) continue;
+    if (formatted[i] == _T('\n')) (*dn)[j] = _T('\0');
+    else (*dn)[j] = formatted[i];
     j++;
   }
 
-- 
2.20.1