msvcrt: Fix buffer size checks in swscanf_s.

dlls/msvcrt/scanf.h

@@ -540,7 +540,7 @@ _FUNCTION_ {
                     char *str = suppress ? NULL : va_arg(ap, char*);
                     char *pstr = str;
 #ifdef SECURE
-                    unsigned size = suppress ? UINT_MAX : va_arg(ap, unsigned)/sizeof(char);
+                    unsigned size = suppress ? UINT_MAX : va_arg(ap, unsigned);
 #else
                     unsigned size = UINT_MAX;
 #endif
@@ -566,7 +566,7 @@ _FUNCTION_ {
                     MSVCRT_wchar_t *str = suppress ? NULL : va_arg(ap, MSVCRT_wchar_t*);
                     MSVCRT_wchar_t *pstr = str;
 #ifdef SECURE
-                    unsigned size = suppress ? UINT_MAX : va_arg(ap, unsigned)/sizeof(MSVCRT_wchar_t);
+                    unsigned size = suppress ? UINT_MAX : va_arg(ap, unsigned);
 #else
                     unsigned size = UINT_MAX;
 #endif
@@ -615,7 +615,7 @@ _FUNCTION_ {
                     ULONG *Mask;
 		    int invert = 0; /* Set if we are NOT to find the chars */
 #ifdef SECURE
-                    unsigned size = suppress ? UINT_MAX : va_arg(ap, unsigned)/sizeof(_CHAR_);
+                    unsigned size = suppress ? UINT_MAX : va_arg(ap, unsigned);
 #else
                     unsigned size = UINT_MAX;
 #endif

dlls/msvcrt/tests/scanf.c

@@ -324,9 +324,43 @@ static void test_swscanf( void )
     ok(c == 'b', "c = %x\n", c);
 }
 
+static void test_swscanf_s(void)
+{
+    static const wchar_t fmt1[] = {'%','c',0};
+    static const wchar_t fmt2[] = {'%','[','a','-','z',']',0};
+
+    int (WINAPIV *pswscanf_s)(const wchar_t*,const wchar_t*,...);
+    HMODULE hmod = GetModuleHandleA("msvcrt.dll");
+    wchar_t buf[2], out[2];
+    int ret;
+
+    pswscanf_s = (void*)GetProcAddress(hmod, "swscanf_s");
+    if(!pswscanf_s) {
+        win_skip("swscanf_s not available\n");
+        return;
+    }
+
+    buf[0] = 'a';
+    buf[1] = '1';
+    out[1] = 'b';
+    ret = pswscanf_s(buf, fmt1, out, 1);
+    ok(ret == 1, "swscanf_s returned %d\n", ret);
+    ok(out[0] == 'a', "out[0] = %x\n", out[0]);
+    ok(out[1] == 'b', "out[1] = %x\n", out[1]);
+
+    ret = pswscanf_s(buf, fmt2, out, 1);
+    ok(!ret, "swscanf_s returned %d\n", ret);
+
+    ret = pswscanf_s(buf, fmt2, out, 2);
+    ok(ret == 1, "swscanf_s returned %d\n", ret);
+    ok(out[0] == 'a', "out[0] = %x\n", out[0]);
+    ok(!out[1], "out[1] = %x\n", out[1]);
+}
+
 START_TEST(scanf)
 {
     test_sscanf();
     test_sscanf_s();
     test_swscanf();
+    test_swscanf_s();
 }