kernel32: Fix write buffer overrun in format_insertW.

1cd39515 · Dan Kegel · Alexandre Julliard · 0909e8b1 · 1cd39515
Commit 1cd39515 authored Dec 01, 2009 by Dan Kegel Committed by Alexandre Julliard Dec 02, 2009
Hide whitespace changes
Inline Side-by-side

Showing with 1 addition and 1 deletion

format_msg.c dlls/kernel32/format_msg.c +1 -1

No files found.
--- a/dlls/kernel32/format_msg.c
+++ b/dlls/kernel32/format_msg.c
@@ -356,7 +356,7 @@ static LPCWSTR format_insertW( int insert, LPCWSTR format, DWORD flags,
             (format[0] == 'C'))
    {
        char ch = arg;
-        wstring = HeapAlloc( GetProcessHeap(), 0, 2 );
+        wstring = HeapAlloc( GetProcessHeap(), 0, 2 * sizeof(WCHAR) );
        MultiByteToWideChar( CP_ACP, 0, &ch, 1, wstring, 1 );
        wstring[1] = 0;
        arg = (ULONG_PTR)wstring;