Dan Kegel : kernel32: Fix write buffer overrun in format_insertW.

[Alexandre Julliard]

Module: wine
Branch: master
Commit: 1cd395153da2ac340e2f5e2e45129d71d93ce332
URL:    http://source.winehq.org/git/wine.git/?a=commit;h=1cd395153da2ac340e2f5e2e45...

Author: Dan Kegel <dank(a)kegel.com>
Date:   Tue Dec  1 21:24:11 2009 -0800

kernel32: Fix write buffer overrun in format_insertW.

---

 dlls/kernel32/format_msg.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/dlls/kernel32/format_msg.c b/dlls/kernel32/format_msg.c
index 4b5b00c..c312acd 100644
--- a/dlls/kernel32/format_msg.c
+++ b/dlls/kernel32/format_msg.c
@@ -356,7 +356,7 @@ static LPCWSTR format_insertW( int insert, LPCWSTR format, DWORD flags,
              (format[0] == 'C'))
     {
         char ch = arg;
-        wstring = HeapAlloc( GetProcessHeap(), 0, 2 );
+        wstring = HeapAlloc( GetProcessHeap(), 0, 2 * sizeof(WCHAR) );
         MultiByteToWideChar( CP_ACP, 0, &ch, 1, wstring, 1 );
         wstring[1] = 0;
         arg = (ULONG_PTR)wstring;