commit 81fe8ce185e44714ab55fb194294d77a7976d91e
Author:     James Haley <haleyjd@hotmail.com>
AuthorDate: Wed Aug 24 00:33:42 2016 -0500
Commit:     James Haley <haleyjd@hotmail.com>
CommitDate: Wed Aug 24 00:33:42 2016 -0500

    Ensure values retrieved with RegQueryValueEx are null-terminated.

    According to MSDN, an application can write REG_SZ values without a
    null-terminating byte. We will not trust that the registry keys we
    are looking for were actually written by the well-known, trusted
    applications assumed to create them, and instead allocate the buffer
    at size+1 and manually terminate it.

    cf. https://msdn.microsoft.com/en-us/library/windows/desktop/ms724911(v=vs.85).aspx
---
 src/d_iwad.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/src/d_iwad.c b/src/d_iwad.c
index 2e91a5a1..2a446db4 100644
--- a/src/d_iwad.c
+++ b/src/d_iwad.c
@@ -256,7 +256,7 @@ static char *GetRegistryString(registry_value_t *reg_val)
     {
         // Allocate a buffer for the value and read the value

-        result = malloc(len);
+        result = malloc(len + 1);

         if (RegQueryValueEx(key, reg_val->value, NULL, &valtype,
                             (unsigned char *) result, &len) != ERROR_SUCCESS)
@@ -264,6 +264,11 @@ static char *GetRegistryString(registry_value_t *reg_val)
             free(result);
             result = NULL;
         }
+        else
+        {
+            // Ensure the value is null-terminated
+            result[len] = '\0';
+        }
     }

     // Close the key