Fix a crash in _winreg_QueryValue

Coverity ID 474, value_length and type are both unique, not ref pointers and
can thus be NULL.

Karolin, please merge this to -stable.

Thanks,

Volker
(cherry picked from commit 999533c0ccced59141d8baff5bc248d63e2a966f)

diff --git a/source/rpc_server/srv_winreg_nt.c b/source/rpc_server/srv_winreg_nt.c
index 7b7487110481fab7abe4a6f0ada2a78307722a4b..84bcf0bf8921952682859123fb876828f25c2206 100644 (file)
--- a/source/rpc_server/srv_winreg_nt.c
+++ b/source/rpc_server/srv_winreg_nt.c
@@ -230,6 +230,10 @@ WERROR _winreg_QueryValue(pipes_struct *p, struct winreg_QueryValue *r)
        if ( !regkey )
                return WERR_BADFID;
 
+       if ((r->out.value_length == NULL) || (r->out.type == NULL)) {
+               return WERR_INVALID_PARAM;
+       }
+
        *r->out.value_length = *r->out.type = REG_NONE;
        
        DEBUG(7,("_reg_info: policy key name = [%s]\n", regkey->key->name));