void RegKey::getBinary(const TCHAR* valname, void** data, int* length) const {
  TCharArray hex(getRepresentation(valname));
  if (!rdr::HexInStream::hexStrToBin(CStr(hex.buf), (char**)data, length))
    throw rdr::Exception("getBinary failed");
}
The software writes data past the end, or before the beginning, of the intended buffer.