Security fixes

src/Installer.cpp

@@ -612,8 +612,7 @@ static void ForAllUsersStateChanged() {
     str::ReplacePtr(&cli->installDir, str::Dup(dir));
     gWnd->editInstallationDir->SetText(cli->installDir);
     logf("ForAllUsersStateChanged: cli->allUsers: %d, cli->installDir: '%s', forAllUsers: %d\n", (int)cli->allUsers,
-         cli->installDir),
-        (int)forAllUsers;
+         cli->installDir, (int)forAllUsers);
 }
 
 static void UpdateUIForOptionsState(InstallerWnd* wnd) {

src/SumatraPDF.cpp

@@ -3269,7 +3269,7 @@ void CloseTab(WindowTab* tab, bool quitIfLast) {
         return;
     }
     MainWindow* win = tab->win;
-    logf("CloseTab: tab: 0x%p win: 0x%p, hwndFrame: 0x%x, quitIfLast: %d, dm: 0x%p\n", tab, win, win->hwndFrame,
+    logf("CloseTab: tab: 0x%p win: 0x%p, hwndFrame: %p, quitIfLast: %d, dm: 0x%p\n", tab, win, win->hwndFrame,
          (int)quitIfLast, tab->AsFixed());
 
     AbortFinding(win, true);

src/utils/WebpReader.cpp

@@ -38,7 +38,8 @@ Gdiplus::Bitmap* ImageFromData(const ByteSlice& d) {
     if (ok != Gdiplus::Ok) {
         return nullptr;
     }
-    if (!WebPDecodeBGRAInto((const u8*)d.data(), d.size(), (u8*)bmpData.Scan0, bmpData.Stride * h, bmpData.Stride)) {
+    if (!WebPDecodeBGRAInto((const u8*)d.data(), d.size(), (u8*)bmpData.Scan0,
+                            static_cast<size_t>(bmpData.Stride) * static_cast<size_t>(h), bmpData.Stride)) {
         return nullptr;
     }
     bmp.UnlockBits(&bmpData);

src/utils/WinUtil.cpp

@@ -565,14 +565,20 @@ static void ResetRegKeyAcl(HKEY hkey, const char* keyName) {
         return;
     }
     SECURITY_DESCRIPTOR secdesc;
-    InitializeSecurityDescriptor(&secdesc, SECURITY_DESCRIPTOR_REVISION);
+    if (!InitializeSecurityDescriptor(&secdesc, SECURITY_DESCRIPTOR_REVISION)) {
+        RegCloseKey(hKey);
+        return;
+    }
 
-#pragma warning(push)
-#pragma warning(disable : 6248)
-    // "Setting a SECURITY_DESCRIPTOR's DACL to nullptr will result in an unprotected object"
-    // https://docs.microsoft.com/en-us/cpp/code-quality/c6248?view=msvc-170
-    SetSecurityDescriptorDacl(&secdesc, TRUE, nullptr, TRUE);
-#pragma warning(pop)
+    ACL dacl;
+    if (!InitializeAcl(&dacl, sizeof(dacl), ACL_REVISION)) {
+        RegCloseKey(hKey);
+        return;
+    }
+    if (!SetSecurityDescriptorDacl(&secdesc, TRUE, &dacl, FALSE)) {
+        RegCloseKey(hKey);
+        return;
+    }
 
     RegSetKeySecurity(hKey, DACL_SECURITY_INFORMATION, &secdesc);
     RegCloseKey(hKey);