Fix off-by-one overflow in windows_get_registry_files()

[saddamr3e]

Fix an off-by-one heap buffer overflow in windows_get_registry_files() when accumulating manifest paths enumerated from Windows registry locations.

The growth check reserved space for the new path and terminating null byte, but failed to account for the additional PATH_SEPARATOR inserted before appended entries. Under specific path-length combinations, this allowed a one-byte write past the end of the allocated buffer.

This change:

• Corrects the capacity check to reserve space for:

  • existing contents
  • PATH_SEPARATOR
  • new path
  • null terminator

• Uses the actual destination capacity when calling snprintf()

• Bounds appended writes using the remaining buffer size

• Adds a regression test that reproduces the boundary condition which previously triggered the overflow

Root Cause

When appending a new registry entry, the code checked:

strlen(*reg_data) + name_size + 1 > *reg_data_size

but the subsequent write emitted:

PATH_SEPARATOR + name + '\0'

which requires an additional byte for the separator.

As a result, if:

strlen(*reg_data) + name_size + 1 == *reg_data_size

the buffer would not be grown and the terminating null byte would be written one byte beyond the allocation.

Testing

Added RegistryManifestParsing.AppendAtBufferBoundaryDoesNotOverflow.

The test constructs registry value names whose combined lengths place the final append exactly at the original 4096-byte allocation boundary. Prior to this fix, the test triggers a one-byte heap overflow (detectable under ASAN). After the fix, the buffer is correctly expanded and instance creation completes successfully.

Impact

Prevents a heap-based off-by-one overflow during Windows registry manifest enumeration and improves the robustness of buffer-bound calculations in this code path.

[ci-tester-lunarg]

Author saddamr3e not on autobuild list. Waiting for curator authorization before starting CI build.

[ci-tester-lunarg]

Author saddamr3e not on autobuild list. Waiting for curator authorization before starting CI build.

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}