From 2fcb132d60534772e91f4ac6d3d557a52bf334bb Mon Sep 17 00:00:00 2001 From: Mack Straight Date: Sat, 3 Oct 2026 10:47:42 -0400 Subject: [PATCH] installer: walk the hardware ID list correctly when uninstalling RemoveDeviceNode looks for the SAR device among all MEDIA class devices by comparing each entry of its hardware ID list. The loop's bound compared the pointer with itself plus the length (always true), and each step skipped two characters past the end of a string instead of one. Only the first ID of each device was compared correctly, the rest were compared from their second character, and for every device that didn't match, the walk read past the end of the buffer (and kept going while it found non-zero memory there). SAR's own device has a single ID and is matched first, which is why uninstall worked; other audio devices made it read out of bounds. Co-Authored-By: Claude Opus 5.5 --- SarInstallerActions/devnode.cpp | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/SarInstallerActions/devnode.cpp b/SarInstallerActions/devnode.cpp index 6e8f2d8..59eaf46 100644 --- a/SarInstallerActions/devnode.cpp +++ b/SarInstallerActions/devnode.cpp @@ -156,9 +156,10 @@ UINT __stdcall RemoveDeviceNode(MSIHANDLE hInstall) BOOL found = FALSE; + // A REG_MULTI_SZ: strings separated by one null, ended by two. for (WCHAR *p = buffer; - p < p + requiredSize / sizeof(WCHAR) && *p; - p += lstrlen(p) + 2) { + p < buffer + requiredSize / sizeof(WCHAR) && *p; + p += lstrlen(p) + 1) { if (!lstrcmpi(p, HARDWARE_ID)) { found = TRUE;