eric pouech (@epo) commented about dlls/kernelbase/console.c:
if (!(params = HeapAlloc( GetProcessHeap(), 0, max_size )))
{
SetLastError( ERROR_NOT_ENOUGH_MEMORY );
return 0;
}
if (!console_ioctl( RtlGetCurrentPeb()->ProcessParameters->ConsoleHandle, IOCTL_CONDRV_GET_TITLE,
NULL, 0, title, (size - 1) * sizeof(WCHAR), &size ))
&size, sizeof(size), params, max_size, &size )) return 0;
- size /= sizeof(WCHAR);
- title[size] = 0;
- return size + 1;
- size -= sizeof(*params);
you could be paranoid by checking that size is >= sizeof(*params)