-
Zhiyi Zhang authored
When len is 256, (ARRAY_SIZE(title) - len) is 0. When LoadStringW() is called with the last parameter being zero, a WCHAR string pointer is stored at 'title + 256', writing title out of bounds.
6164432a
When len is 256, (ARRAY_SIZE(title) - len) is 0. When LoadStringW() is called with the last parameter being zero, a WCHAR string pointer is stored at 'title + 256', writing title out of bounds.