From: Francis De Brabandere <francisdb@gmail.com> GetFullPathNameW returns the required buffer size including the terminating NUL character, but the result was passed directly to SysAllocStringLen, which expects the string length excluding the NUL. As a result, the BSTR stored in struct folder's path field had a length prefix one greater than the actual string content. The bug was not observable via folder_get_Path or folder_get_Name because both use the NUL-terminated view of the buffer, but it misdirects any internal code that uses SysStringLen on the stored path. --- dlls/scrrun/filesystem.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/dlls/scrrun/filesystem.c b/dlls/scrrun/filesystem.c index ae6c583fd06..6af73acbd79 100644 --- a/dlls/scrrun/filesystem.c +++ b/dlls/scrrun/filesystem.c @@ -2740,7 +2740,9 @@ HRESULT create_folder(const WCHAR *path, IFolder **folder) return E_FAIL; } - object->path = SysAllocStringLen(NULL, len); + /* GetFullPathNameW returns the required size including the NUL terminator, + * so the BSTR length prefix must be one less. */ + object->path = SysAllocStringLen(NULL, len - 1); if(!object->path) { free(object); -- GitLab https://gitlab.winehq.org/wine/wine/-/merge_requests/10661