#482 NULL pointer dereference in NTRegistryKeyLookup

[bestshow]

Here is the critical code: (in NTRegistryKeyLookup)

   dest = MagickAllocateMemory(unsigned char *,size); //1915

    res = RegQueryValueExA (reg_key, subkey, 0, &type, dest, &size);
    if (res == ERROR_MORE_DATA && type == REG_SZ)
      {
        MagickReallocMemory(unsigned char *,dest,size);
        res = RegQueryValueExA (reg_key, subkey, 0, &type, dest, &size);
      }

    if (type != REG_SZ || res != ERROR_SUCCESS)
      {
        MagickFreeMemory(dest);
      }

MagickAllocateMemory(...) may return NULL, so the following operations on the "dest" will Dereference Null pointer to cause memory error.

Credit : ADLab of Venustech

[Bob Friesenhahn]

This problem is fixed by Mercurial changeset 15188:59b266bdfcf3. Thanks for the report!