Huw Davies (@huw) commented about dlls/sapi/token.c:
+ + if (FAILED(hr = ISpObjectToken_OpenKey( token, L"Attributes", &attrs_key ))) + return hr == SPERR_NOT_FOUND ? S_OK : hr; + + memset( match, 0, sizeof(match) ); + + /* attrs is a semicolon-separated list of attribute clauses. + * Each clause consists of an attribute name and an optional operator and value. + * The meaning of a clause depends on the operator given: + * If no operator is given, the attribute must exist. + * If the operator is '=', the attribute must contain the given value. + * If the operator is '!=', the attribute must not exist or contain the given value. + */ + if (!(buf = wcsdup( attrs ))) return E_OUTOFMEMORY; + for ( attr = wcstok( buf, L";", &attr_ctx ), i = 0; attr && i < 64; + attr = wcstok( NULL, L";", &attr_ctx ), i++ ) Let's explicitly use `wcstok_s()`.
-- https://gitlab.winehq.org/wine/wine/-/merge_requests/2905#note_34439