uninit in WS2_32.dll!NSCATALOGENTRY::IoRegistry

_From [bruen...@google.com](https://code.google.com/u/109494838902877177630/) on April 22, 2011 15:34:03_

running a copy of net_unittests.exe on XP:
% /usr/bin/time ~/drmemory/git/build_drmemory/bin/drmemory.exe -batch -debug -dr c:/src/dr/git/exports -- ./net_unittests.exe --gtest_filter="URLRequestTestHTTP.ProxyTunnelRedirectTest"

the test fails to run fully b/c I don't have various other utils:
[296:788:0422/145704:179867484:ERROR:test_server_win.cc(187)] Failed to launch "E:\derek\third_party\python_26\python.exe" "E:\derek\net\tools\testserver\testserver.py" --port=0 --data-dir="E:\derek\net/data/url_request_unittest" --startup-pipe=552

but it hits this error:
Error `#1`: UNINITIALIZED READ: reading 0x0012fa74-0x0012fa78 4 byte(s)
@0:00:15.125 in thread 2140
0x01f27803 ADVAPI32.dll!RegQueryValueExA
??:0
0x71c06869 WS2_32.dll!NSCATALOGENTRY::IoRegistry
??:0
0x71c067a7 WS2_32.dll!NSCATALOGENTRY::InitializeFromRegistry
??:0
0x71c06654 WS2_32.dll!NSCATALOG::RefreshFromRegistry
??:0
0x71c0609b WS2_32.dll!NSCATALOG::InitializeFromRegistry
??:0
0x71c06038 WS2_32.dll!DPROCESS::Initialize
??:0
0x71c05f50 WS2_32.dll!DPROCESS::DProcessClassInitialize
??:0
0x015216a1 net_unittests.exe!?
??:0

0:000> U 71c06848 L10
WS2_32!NSCATALOGENTRY::IoRegistry+0xaf:
71c06848 0f8448720000 je WS2_32!NSCATALOGENTRY::IoRegistry+0x14a (71c0da96)
71c0684e 8d85f0feffff lea eax,[ebp-0x110]
71c06854 50 push eax
71c06855 53 push ebx
71c06856 53 push ebx
71c06857 53 push ebx
71c06858 68246ac071 push 0x71c06a24
71c0685d ffb5f4feffff push dword ptr [ebp-0x10c]
71c06863 ff150c10c071 call dword ptr [WS2_32!_imp__RegQueryValueExA (71c0100c)]
0:000> da 71c06a24
71c06a24 "DisplayString"

looks like a real bug: the 6th and final parameter to RegQueryValueExA,
lpcbData, is uninitialized. it's a local var slot and this routine does
not initialize it:

WS2_32!NSCATALOGENTRY::IoRegistry:
71c067d0 8bff mov edi,edi
71c067d2 55 push ebp
71c067d3 8bec mov ebp,esp
71c067d5 81ec18010000 sub esp,0x118
71c067db a15c40c171 mov eax,[WS2_32!__security_cookie (71c1405c)]
71c067e0 53 push ebx
71c067e1 56 push esi
71c067e2 8945fc mov [ebp-0x4],eax
71c067e5 8b4508 mov eax,[ebp+0x8]
71c067e8 33db xor ebx,ebx
71c067ea 395d0c cmp [ebp+0xc],ebx
71c067ed 57 push edi
71c067ee 8bf1 mov esi,ecx
71c067f0 8985f4feffff mov [ebp-0x10c],eax
71c067f6 bf04010000 mov edi,0x104
71c067fb 0f8457720000 je WS2_32!NSCATALOGENTRY::IoRegistry+0x6b (71c0da58)
71c06801 6a01 push 0x1
71c06803 57 push edi
71c06804 8d8df8feffff lea ecx,[ebp-0x108]
71c0680a 51 push ecx
71c0680b 680865c071 push 0x71c06508
71c06810 50 push eax
71c06811 e8d3f2ffff call WS2_32!ReadRegistryEntry (71c05ae9)
71c06816 3bc3 cmp eax,ebx
71c06818 0f848e730000 je WS2_32!NSCATALOGENTRY::IoRegistry+0x35c (71c0dbac)
71c0681e 57 push edi
71c0681f 8d4634 lea eax,[esi+0x34]
71c06822 50 push eax
71c06823 6aff push 0xff
71c06825 8d85f8feffff lea eax,[ebp-0x108]
71c0682b 50 push eax
71c0682c 53 push ebx
71c0682d 53 push ebx
71c0682e ff150411c071 call dword ptr [WS2_32!_imp__MultiByteToWideChar (71c01104)]
71c06834 33c9 xor ecx,ecx
71c06836 85c0 test eax,eax
71c06838 0f9fc1 setnle cl
71c0683b 8bc1 mov eax,ecx
71c0683d 3bc3 cmp eax,ebx
71c0683f 0f8467730000 je WS2_32!NSCATALOGENTRY::IoRegistry+0x35c (71c0dbac)
71c06845 395d0c cmp [ebp+0xc],ebx
71c06848 0f8448720000 je WS2_32!NSCATALOGENTRY::IoRegistry+0x14a (71c0da96)
71c0684e 8d85f0feffff lea eax,[ebp-0x110]
71c06854 50 push eax
71c06855 53 push ebx
71c06856 53 push ebx
71c06857 53 push ebx
71c06858 68246ac071 push 0x71c06a24
71c0685d ffb5f4feffff push dword ptr [ebp-0x10c]
71c06863 ff150c10c071 call dword ptr [WS2_32!_imp__RegQueryValueExA (71c0100c)]

lpData here is NULL. RegQueryValueExA docs don't make it completely clear,
but the implementation seems to read *lpcbData even if lpData is NULL, so
it can return ERROR_MORE_DATA, supporting a usage model where one first
queries the size, and that query doesn't need to pass a valid buffer.

ADVAPI32!RegQueryValueExA+0x1b4:
01f277eb ff7508 push dword ptr [ebp+0x8]
01f277ee 8d45f4 lea eax,[ebp-0xc]
01f277f1 57 push edi
01f277f2 50 push eax
01f277f3 ff150012f101 call dword ptr [ADVAPI32!_imp__RtlUnicodeToMultiByteSize (01f11200)]
01f277f9 8b4d1c mov ecx,[ebp+0x1c]
01f277fc 3bce cmp ecx,esi
01f277fe 8b45f4 mov eax,[ebp-0xc]
01f27801 7408 jz ADVAPI32!RegQueryValueExA+0x20c (01f2780b)
ADVAPI32!RegQueryValueExA+0x1cc:
01f27803 3b01 cmp eax,[ecx]
01f27805 0f87bfe1ffff jnbe ADVAPI32!RegQueryValueExA+0x1d0 (01f259ca)

_Original issue: http://code.google.com/p/drmemory/issues/detail?id=351_