[issue9194] winreg:fixupMultiSZ should check that P < Q in the inner loop

[Steve Dower]

Steve Dower <steve.dower at python.org> added the comment:

Thanks Zackery! I've merged this main part of the fix (though it requires a manual backport to 2.7). As it's a buffer overrun, I've sent it back to 3.6 as well.

Eryk - thanks for the additional detail. I wonder whether it would be just as easy to guarantee an over-allocation in this case and force a null terminator? (In fact, that would probably have handled the same case that Zackery just fixed, but we didn't have a patch ready for that approach)

----------
stage: patch review -> backport needed

_______________________________________
Python tracker <report at bugs.python.org>
<https://bugs.python.org/issue9194>
_______________________________________