Dan Kegel : advpack: fix off-by-one error in AdvInstallFileW that caused buffer overrun.

[Alexandre Julliard]

Module: wine
Branch: master
Commit: ced19b425a7db2ca88dbfa5de429f20075b4c6d2
URL:    http://source.winehq.org/git/wine.git/?a=commit;h=ced19b425a7db2ca88dbfa5de4...

Author: Dan Kegel <dank(a)kegel.com>
Date:   Thu Nov 26 21:46:51 2009 -0800

advpack: fix off-by-one error in AdvInstallFileW that caused buffer overrun.

---

 dlls/advpack/files.c |    4 ++--
 1 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/dlls/advpack/files.c b/dlls/advpack/files.c
index 216b863..679d236 100644
--- a/dlls/advpack/files.c
+++ b/dlls/advpack/files.c
@@ -279,13 +279,13 @@ HRESULT WINAPI AdvInstallFileW(HWND hwnd, LPCWSTR lpszSourceDir, LPCWSTR lpszSou
     if (lpszDestFile)
     {
         dwLen = lstrlenW(lpszDestFile);
-        szDestFilename = HeapAlloc(GetProcessHeap(), 0, dwLen * sizeof(WCHAR));
+        szDestFilename = HeapAlloc(GetProcessHeap(), 0, (dwLen+1) * sizeof(WCHAR));
         lstrcpyW(szDestFilename, lpszDestFile);
     }
     else
     {
         dwLen = lstrlenW(lpszSourceFile);
-        szDestFilename = HeapAlloc(GetProcessHeap(), 0, dwLen * sizeof(WCHAR));
+        szDestFilename = HeapAlloc(GetProcessHeap(), 0, (dwLen+1) * sizeof(WCHAR));
         lstrcpyW(szDestFilename, lpszSourceFile);
     }