Index: /trunk/include/regfi.h
===================================================================
--- /trunk/include/regfi.h	(revision 130)
+++ /trunk/include/regfi.h	(revision 131)
@@ -391,5 +391,5 @@
 
 uint8* regfi_parse_data(REGF_FILE* file, uint32 offset, 
-			uint32 length, bool strict);
+			uint32 length, uint32 max_size, bool strict);
 
 REGF_SK_REC* regfi_parse_sk(REGF_FILE* file, uint32 offset, uint32 max_size, bool strict);
@@ -401,5 +401,5 @@
 
 char* regfi_parse_classname(REGF_FILE* file, uint32 offset,
-			    uint16* name_length, bool strict);
+			    uint16* name_length, uint32 max_size, bool strict);
 
 
Index: /trunk/lib/regfi.c
===================================================================
--- /trunk/lib/regfi.c	(revision 130)
+++ /trunk/lib/regfi.c	(revision 131)
@@ -796,5 +796,5 @@
     
     vk_offset =  voffsets[i] + REGF_BLOCKSIZE;
-    vk_max_length = hbin->block_size - vk_offset + sizeof(uint32);
+    vk_max_length = hbin->block_size + hbin->file_off - vk_offset;
     ret_val[i] = regfi_parse_vk(file, vk_offset, vk_max_length, strict);
     if(ret_val[i] == NULL)
@@ -1604,7 +1604,8 @@
 {
   uint8 nk_header[REGFI_NK_MIN_LENGTH];
+  REGF_HBIN *hbin;
   REGF_NK_REC* ret_val;
-  uint32 length;
-  uint32 cell_length;
+  uint32 length,cell_length;
+  uint32 class_offset, class_maxsize;
   bool unalloc = false;
 
@@ -1722,7 +1723,15 @@
   if(ret_val->classname_off != REGF_OFFSET_NONE)
   {
-    ret_val->classname 
-      = regfi_parse_classname(file, ret_val->classname_off+REGF_BLOCKSIZE,
-			      &ret_val->classname_length, strict);
+    hbin = regfi_lookup_hbin(file, ret_val->classname_off);
+    if(hbin)
+    {
+      class_offset = ret_val->classname_off+REGF_BLOCKSIZE;
+      class_maxsize = hbin->block_size + hbin->file_off - class_offset;
+      ret_val->classname
+	= regfi_parse_classname(file, class_offset, &ret_val->classname_length, 
+				class_maxsize, strict);
+    }
+    else
+      ret_val->classname = NULL;
     /*
     if(strict && ret_val->classname == NULL)
@@ -1735,9 +1744,6 @@
 
 
-/*******************************************************************/
-/* XXX: Not currently validating against hbin length.              */
-/*******************************************************************/
 char* regfi_parse_classname(REGF_FILE* file, uint32 offset, 
-			    uint16* name_length, bool strict)
+			    uint16* name_length, uint32 max_size, bool strict)
 {
   char* ret_val = NULL;
@@ -1748,13 +1754,23 @@
   if(*name_length > 0 && offset != REGF_OFFSET_NONE 
      && offset == (offset & 0xFFFFFFF8))
-  {    
+  {
     if(!regfi_parse_cell(file->fd, offset, NULL, 0, &cell_length, &unalloc))
 	return NULL;
 
-    if(cell_length < *name_length)
+    if((cell_length & 0xFFFFFFF8) != cell_length)
+      return NULL;
+    
+    if(cell_length > max_size)
     {
       if(strict)
 	return NULL;
-      *name_length = cell_length & 0xFFFFFFF8;
+      cell_length = max_size;
+    }
+
+    if((cell_length - 4) < *name_length)
+    {
+      if(strict)
+	return NULL;
+      *name_length = cell_length - 4;
     }
     
@@ -1784,6 +1800,8 @@
 {
   REGF_VK_REC* ret_val;
+  REGF_HBIN *hbin;
   uint8 vk_header[REGFI_VK_MIN_LENGTH];
   uint32 raw_data_size, length, cell_length;
+  uint32 data_offset, data_maxsize;
   bool unalloc = false;
 
@@ -1878,6 +1896,15 @@
   else
   {
-    ret_val->data = regfi_parse_data(file, ret_val->data_off+REGF_BLOCKSIZE,
-				     raw_data_size, strict);
+    hbin = regfi_lookup_hbin(file, ret_val->data_off);
+    if(hbin)
+    {
+      data_offset = ret_val->data_off+REGF_BLOCKSIZE;
+      data_maxsize = hbin->block_size + hbin->file_off - data_offset;
+      ret_val->data = regfi_parse_data(file, data_offset, raw_data_size,
+				       data_maxsize, strict);
+    }
+    else
+      ret_val->data = NULL;
+
     if(strict && (ret_val->data == NULL))
     {
@@ -1892,5 +1919,6 @@
 
 
-uint8* regfi_parse_data(REGF_FILE* file, uint32 offset, uint32 length, bool strict)
+uint8* regfi_parse_data(REGF_FILE* file, uint32 offset, uint32 length,
+			uint32 max_size, bool strict)
 {
   uint8* ret_val;
@@ -1921,4 +1949,12 @@
     if((cell_length & 0xFFFFFFF8) != cell_length)
       return NULL;
+
+    if(cell_length > max_size)
+    {
+      if(strict)
+	return NULL;
+      else
+	cell_length = max_size;
+    }
 
     if(cell_length - 4 < length)
@@ -1933,8 +1969,4 @@
 	length = cell_length - 4;
     }
-
-    /* XXX: There is currently no check to ensure the data 
-     *      cell doesn't cross HBIN boundary.
-     */
 
     if((ret_val = (uint8*)zalloc(sizeof(uint8)*length)) == NULL)
