Zebediah Figura (@zfigura) commented about dlls/user32/msgbox.c:
+ GetWindowTextW(hItem, buffer, 1024); + while(buffer[j] != 0) + { + if(buffer[j] != '&') + text[k++] = buffer[j]; + j++; + } + text[k] = 0; + lstrcatW(text, spaces); + } + } + + lstrcatW(text, carriage); + lstrcatW(text, line); + + hMem = GlobalAlloc(GMEM_MOVEABLE|GMEM_DDESHARE|GMEM_ZEROINIT, (len + 1) * sizeof(WCHAR)); GMEM_ZEROINIT isn't doing anything here.
"(len + 1) * sizeof(WCHAR)" is wrong, since "len" is already in bytes and includes the null terminator. -- https://gitlab.winehq.org/wine/wine/-/merge_requests/5247#note_64999